Web Development Tools Vulnerabilities

Organizations have varying levels of web “presence” depending on the need of the business. An organization may have a small website with one person managing the content. Another organization may have a dynamic, rich, and extensive web presence across multiple mediums, requiring multiple teams across the world. Regardless of where an organization lands between those ends of web development, they all need tools to do the work. Like any piece of software, eventually there will be vulnerabilities discovered within the web development tools that will need to be addressed.

The best method to discover vulnerabilities with Tenable SecurityCenter Continuous View (CV) is to perform both active scanning and passive monitoring. When using both methods to collect vulnerability data, analysts using SecurityCenter CV can find vulnerabilities associated with web development tools much faster. With this information, the appropriate remediation actions can be taken. Depending on the situation, older web development tools may be needed to support legacy web applications and content platforms. This dashboard allows analysts to properly assess the risk to the organization with the discovered web development tools.

Web developers use a variety of tools such as Microsoft Visual Studio, Adobe Dreamweaver, and more. As these tools can be installed across multiple platforms, Nessus and the Passive Vulnerability Scanner (PVS) will detect and identify these tools. Analysts will see vulnerabilities associated with these tools that may require coordination with developers to remediate, when possible. This dashboard also provides analysts with a snapshot of these vulnerabilities over time, as well as by vendor.

Analysts can see detailed information of vulnerabilities such as whether or not the vulnerability is exploitable. Even just a handful of exploitable vulnerabilities across the organization can leave the organization open to attack. In some cases, developers grab code from the internet to fix an issue or test out a new feature. If the developers are provided with a custom piece of code from the internet, the code could be malicious in nature and rely upon an older version of a web development tool. With this malicious code running on an outdated version of the tool, an attacker could gain a foothold within the organization. Remediating the vulnerability or mitigating the risk of the vulnerable tool can help an organization stay secure.

This dashboard is available in the SecurityCenter Feed, a comprehensive collection of dashboards, reports, Assurance Report Cards, and assets. The dashboard can be easily located in the SecurityCenter Feed under the category Discovery & Detection. The dashboard requirements are:

• SecurityCenter 5.4
• Nessus 6.7
• PVS 5.1

Tenable SecurityCenter Continuous View (CV) provides continuous network monitoring, vulnerability identification, and security monitoring. SecurityCenter is continuously updated with information about advanced threats and zero-day vulnerabilities, and new types of regulatory compliance configuration audit files. Tenable constantly analyzes information from our unique sensors, delivering continuous visibility and critical context, enabling decisive action that transforms your security program from reactive to proactive. Active scanning examines the devices on the systems, running processes and services, detection of vulnerable software development applications, configuration settings, and additional vulnerabilities. With this information, analysts have greater insight to determine if supported software and systems are operating within the organization. Continually scanning the network with passive sensors for servers, desktops and applications helps prioritize security efforts to mitigate threats and weaknesses. Organizations continue to operate with more mobile and transient network devices and need to have a system in place that continuously monitors traffic, devices, applications, and communications across environments. Tenable enables powerful, yet non-disruptive, continuous monitoring of the organization to ensure vulnerabilities are available to analysts.

This dashboard contains the following components:

• Web Development Tools Vulnerabilities - Vulnerabilities by Vendor Summary: This matrix component provides a summary view of web development tool vulnerabilities by vendor
• Web Development Tools Vulnerabilities - Vulnerability Severities At A Glance: This matrix component provides a summary view of the vulnerability severities for web development tools on the network
• Web Development Tools Vulnerabilities - Vulnerability Trend Over The Last 90 Days: This trend line component displays the count of web development tool vulnerabilities over time by vendor
• Web Development Tools Vulnerabilities - Top 25 Vulnerability Details: This table component lists the top 25 vulnerabilities detected for web development tools