00:06
Hi everyone, happy, what's today, Wednesday?  My name is Greg Anderson. I'm the creator and now CEO at DefectDojo.  And so today in office hours, I'll be sharing one of our new features, which is a risk-based and prioritization feature that is  now live for all customers in DefectDojo. And so  first, if you just happened to hear about this session, if you're not familiar with DefectDojo,

00:33
What DefectDojo is, is an open source  platform for vulnerability management and security automation.  We created this about 10 years ago at Rackspace before it became open sourced.  Today we have about 43 million downloads in use by  north of 10K organizations. And the platform itself is all about centralizing security,  doing automation, and trying to remove  as much manual work as possible for security professionals.

01:05
And so how we do that is we just aggregate  the data together from all these different security tools,  put it in one place, auto triage, deduplicate that data, and then  enrich that data. And so one of  the new combinations of all our enrichment is this new risk scoring. And so we created this because the job  of a security professional has never been harder.

01:30
Just this year alone, there was a 25 % plus increase in the number of CVEs.  Software is like milk in that it spoils over time, it does not get better. And unfortunately, we bear the brunt of that  as security professionals.  And so  we feel that  the job of security professionals has never been harder and there's never been  more noise or more issues to wade through.

01:58
when it comes to assessing risk of vulnerabilities and how you prioritize those vulnerabilities.  Or to put it another way, how I used to feel before going to the evil vendor side  is like I was rearranging deck chairs on the Titanic. You know, we talk about all these different things in security, but  oftentimes  what  can be important isn't what really matters. And so that's the other part of building this feature is to

02:28
highlight what matters most to the business and give contextual information to help security professionals advocate for what actually has to get fixed through a scoring methodology. And so,  yeah, just to highlight a little more,  our job is one that is constantly filled with trade-offs in terms of where do we spend time, what do we fix, how do we approach the massive amount of data

02:57
findings and vulnerabilities that a security team has to deal with.

03:04
And so how we actually calculate this  is  there's a lot of interest with regard to risk in the market. And most of what we've seen is based  on a matrixes or something that requires a significant lift to get accurate scoring.  And so when we approached this problem, we wanted to make sure that everything came to a single finite deterministic point to look at. And that also

03:31
that the feature would work really well  right out of the box. So  with no lift, although the scoring  can be customized and adjusted.  And then just a little more in terms of how we think about risk versus priority.  We think of risk as like the simple final contextual decision of any finding the ultimate risk to the business.

03:56
Whereas  priority is just a number that is really meant for absolute triage, if you will. So  if you wanted to know between two issues, which one was more urgent,  priority would be a better thing to look at. Whereas  with regard to risk, urgent is just urgent. It gives  context versus a high level score.

04:21
We kind of think of risk as intended for a more senior audience  and  priority is more of a number that helps people  on the ground,  that's essentially how we've approached it.

04:38
And so with regard to how we actually calculate this and how we come up with this contextualized risk scoring,  we're looking at a number of factors. So of course we're looking at  first the base severity that's reported and then these other factors that DefectDojo  automatically gathers or you can supply. So the number one thing  that will change risk and priority within DefectDojo is if a vulnerability is known to be exploited in the while through EPSS.

05:08
And then from there, we'll move on to look at how many endpoints is this finding affected by? Are these endpoints reachable? And then moving on to user records, we'll look at things like what is the business criticality of what is associated with these findings? Are you storing user records there? Do we have revenue information on that line? Also, it will look at things like compliance fines if...

05:37
certain products or projects are subject to compliance or certain compliance standards. Those were all things that will  amplify or change the priority and risk for any giving finding in DefectDojo.  And then how those calculations actually translate into risk classifications. Generally speaking, anything above needs action is fairly self-explanatory.

06:04
Urgent is  essentially,  it needs to be fixed  as soon as possible. Immediately, it poses an immediate security risk to the organization with a high likelihood of  creating a breach with significant impact to the business. And then medium and low.

06:26
You know  mediums nice if you have bandwidth  low I don't think people are going to spend a lot of time with but what this allows  pro users to do  is  resliced findings based on contextualized risk rather than just looking at  the base severity or what the scanner is reporting.

06:51
Um, so one of the things that we try to do with any feature at DefectDojo  is, um, always be flexible. So when we start talking about the ranges  and what they translate into with regard to the risk, those are actually unique to your organization. So what, one of the things we're looking at is do we have metadata or not to, um, influence and give you the most accurate risk rating possible.

07:17
or are you trying to look at risk and prioritization with no context?  we want people to be able to utilize these things successfully with no lift and accurately, or if they want to get ultra customized, we allow you to do that through the metadata fields currently.  Or  to sort of share my favorite security professional, William Shakespeare,  you can choose to add the metadata or not.

07:45
It will still work and it will still be very accurate, regardless of  which path you want to take. At DefectDojo, one of the things we always want to do is sort of lead with what we believe is the correct view,  but also allow users to customize because in our experience, no two security programs care about the same metrics, no two security programs care about the same risks, et cetera.

08:12
Yeah, and so just going back to highlighting how these scores  are made up.  with regard to the blue,  those are things that DefectDojo will do automatically for you.  And then in the orange is data you can choose to supply if you want to further influence the scores.

08:33
Okay, so moving on to the demo. Chris, I know we also had a couple of questions. Do we want to field questions or go straight to demo? I say let's go to demo first. Okay. So I have two parts to this demo.

08:55
So flipping over to the Pro platform, what I've pulled up here is just a view that looks at  the active findings within the product. And so there are these  two new columns here representing the risk and priority. As always in Pro, you can customize what you see here.  You can remove things from this table. You can drag and drop if you want to have a different ordering.

09:22
But so with regard to risk,  if we sort based on the risk,  what you'll notice  is as we scroll through these critical findings, you'll start to see that there are certain highs that are mixed in. And so it's just a different sort of way of looking at findings  contextually to understand the actual risk and going beyond what the scanner is reporting. And then the other thing

09:51
that will be released, I believe on Monday,  but I have a video preview to show everyone,  is the new Insights dashboard.  Actually, let me hop  really quickly.  So if you're not familiar, we publish various Insights dashboard to give information on things that we think are key to security programs, things like remediation insights. And so there is a new risk and priority insight.

10:21
that will be added to the platform on Monday and to show you  the quick preview on what that will look like.

10:35
Here is that dashboard. So it will break risks down by product, by component, if you're working with SBOMs, if you're working with hosts. gives you this, and these insights dashboards are designed to give a comprehensive view as it relates to risk and priority. The only thing that's missing in this dashboard that people will see on Monday is a list of

11:02
prioritized findings at the bottom with all the risk components that go into prioritization. So it'll be a specific view of the findings and all the different components  that go into  calculating risk and priority.

11:25
We've already had a lot of reception about this feature.  Sometimes when we release a new feature, it takes time for  people to absorb it, people to start using it, and us to eventually get feedback where  this one was  instant. And so we're very aware that people want  further abilities to customize scores and  more data source  enrichment opportunities to further influence risk and priority.

11:55
And so  we hear you, we're working on it. I'm very  proud and appreciative of the reception that  it has had. And these are definitely things that we're aware of that  customers in the community want to see.

12:12
So with that,  that's all the prepared materials I have.  The last thing I wanted to mention is,  we do have this  large open source community around a DefectDojo. So  if these are things that you're interested in, security automation, risk and priority,  please feel free  to participate. It's a welcoming community. It's a warm community and we appreciate.

12:39
you know, anyone that interacts and chooses to participate in any form.