integration with cyberark

[Mark Ma]

at one of my recent conversations regarding storage of security findings, a big boss asked 'where are you storing all of the findings?'

when we realized uncomfortably that our web app storing the vulnerability findings was susceptible to all manner of attacks (such as access escalation and SQLi), there was a nervous hush around the table.

Threadfix should be as secure as possible, since it tends to hold the jewels of the kingdoms it is deployed in.  Would it make sense to integrate it with Cyberark to avoid privilege escalation and theft? 

[Dan Cornell]

Great story. Are you a Cyberark sales person? ;)

ThreadFix undergoes periodic security reviews via SAST, DAST and manual pen testing. Nobody's perfect, but we do have a program in place to proactively identify and resolve potential issues. Are you saying you've identified specific vulnerabilities? Or just that, as a web application, ThreadFix could be targeted with various attacks? If you have any specific vulnerability information, please send my way dan _at_ denimgroup _dot_ com.

Thanks,

Dan

[Mark Ma]

haha..  :D  totally true story. totally not a salesman for Cyber.

and no known vulns, just realized if you have jewels, you will likely be the target of attacks.

i have been thinking quite a bit about your product space.. curious how you compare yourselves to other competitors.. 

personally, i'm very fond of your flexibility. i'm even thinking about integrating feedback from risk assessment tools like Carbon Black.. and wondering if you have any plans to incorporate data from tools other than application focused.. like IPS (PaloAlto, Fortinet..), DLP, maybe even AV (Symantec, Cylance, Traps..)

--
You received this message because you are subscribed to a topic in the Google Groups "ThreadFix" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/threadfix/if19STKlZ3w/unsubscribe.
To unsubscribe from this group and all its topics, send an email to threadfix+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Ben Tomhave]

There's nothing to stop you from leveraging the API integration in CyberArk to script in protection of credentials instead of any that might need to be embedded in threadfix (in lieu of app keys). I would suspect this would be trivially done, and CyberArk might even have script snippits to leverage in jenkins, etc. From what I've seen, their API is straightforward.

To unsubscribe from this group and all its topics, send an email to threadfix+...@googlegroups.com.