Cortex Xpanse scans your public-facing websites, identifying insecure websites, web components, and technologies running on your web assets.
Cortex Xpanse websites data extends Attack Surface Management (ASM) protection by identifying insecure websites, web components, and technologies running on your managed and unmanaged web assets. Cortex Xpanse scans your public-facing websites, creating a continuously updated inventory of your web assets, including the server software and other technologies powering your web applications.
Websites data in Cortex Xpanse enables you to accomplish the following:
Develop a single source of truth for all of your organization's web inventory
Track and monitor your risk due to third-party libraries
Continuously discover and monitor external web application inventory and third-party technologies
Identify insecure and misconfigured websites, vulnerable technologies, and dependencies
Improve security ratings by identifying sites failing security best practices
The difference between websites and services
In Cortex Xpanse, services are public-facing network services; for example, an RDP server or an HTTP server. Websites represent the content and the software stack that was used to generate the website.
An HTTP service represents a single HTTP server (on-prem) or a cohesive group of HTTP servers (cloud). A website can be served by a single HTTP server or by multiple HTTP servers. Some of these HTTP servers could be hosted in a cloud provider, others on-prem. Generally, the relationship between HTTP services and websites can be described as follows:
A website is supported by one or more HTTP services.
A cloud HTTP service serves a single website.
An on-prem HTTP service serves multiple websites, potentially hundreds.
The difference between websites and domains
A domain is simply the registration of a domain (for example, your organization might own www.example.com). You can have a domain without a website behind it. You can also have a domain that does not resolve to an IP address (which means it does not have a website behind it). Cortex Xpanse includes websites with a domain name or an IP address.
Navigate to →
Click on a row in the table to view details about the website.
Attack Surface Rules for Websites
Cortex Xpanse has attack surface rules that detect potential security risks on your websites.
Cortex Xpanse offers two categories of attack surface rules to create alerts on websites:
Web Security Assessments—Includes three attack surface rules (described in the Table 1, “Attack Surface Rules for Websites” table below) that detect website security best practice failures. These are the best practices that are assessed in the Security Best Practices Analysis section of website details pages in the Asset Inventory.
Web Technology CVE Inferences—Includes four attack surface rules (described in the Table 1, “Attack Surface Rules for Websites” table below) that flag web technologies that have inferred CVEs that are both high-confidence matches and high-severity CVEs.
Tip
An important benefit of these attack surface rules is that when they are enabled, Xpanse creates an alert on any new CVE that matches on these criteria. This means you will be notified immediately about zero-day vulnerabilities that are an exact version match.
Attack Surface Rule Category | Attack Surface Rule | Description |
|---|---|---|
Web Security Assessments | Insecure Communication Protocol | Triggers an alert when HTTPS is configured and Protocol Downgrade or HTTP Strict-Transport-Security assessments fail. |
Insecure Content Security | Detects if elements on a webpage are not configured correctly. Examples of content security issues include:
| |
Misconfigured Cross-Site Protections | Cross-site scripting (XSS) is one of the most common attacks against websites, enabling attackers to manipulate data on a webpage or exfiltrate data from users. In response, websites can be equipped with various HTTP headers to mitigate certain attacks. This policy detects the absence or misconfiguration of these security settings, including:
| |
Web Technology CVE Inferences | Insecure Security and Infrastructure Technologies | Flags security and infrastructure technologies with a CPE that correlates to a high severity CVE, for example: a Gitlab instance or Bitbucket server with a CVE. |
Insecure Web Applications | Flags web applications with a CPE that correlates to a high severity CVE, typically server-side software such as a CVE in Wordpress. | |
Insecure Web Frameworks and Libraries | Flags web frameworks and libraries with a CPE that correlates to a high severity CVE. Examples of a web framework include ThinkPHP or Ruby on Rails. Examples of a library include React or jQuery or others. | |
Insecure Web Server Technologies | Flags web server technologies with a CPE that correlates to a high severity CVE, for example: JBoss Application Server, IIS, Apache, or nginx. |
Enable Alerts for Websites
Enable Cortex Xpanse to create alerts when potential risks are observed on your websites.
The attack surface rules for websites are disabled by default. Enable these attack surface rules to enable Xpanse to start creating alerts for websites.
Navigate to → .
Use the filter to find the attack surface rules for websites.
Click the filter icon in the upper right corner to open the filter bar.
In the Select Field dropdown menu, select Attack Surface Rule.
In the Value field dropdown menu, select the two attack surface rule categories for websites: Web Security Assessments and Web Technology CVE Inferences.
Click outside of the filter area into the results table to see the full list of attack surface rules for websites.
For each attack surface rule you want to enable, right click in the appropriate row and select Enable.
Optionally, you can change the default severity that will be assigned to alerts that match the attack surface rule by right-clicking on the rule and choosing from the Change Severity options.