Security Flashcards
Prereq for AppSec
Supported version of Dynatrace
Deep monitoring enabled
3 Modules of AppSec
RVA Runtime Vulnerability Analytics
RAP Runtime Application Protection
SPM Security Posture Management
2 submodules of RVA
Code-level vulnerability detection
Third-party vulnerability detection
Dependency between RAP and RVA
If RAP is enabled, RVA is also automatically enabled
How is consumption tracked for RVA and RAP if you use DPS?
GiB-hour cosumned by hosts with the feature enabled
How is consumption tracked for classic licensing model?
Application Security Units
How are ASUs defined?
RAM in GB / 16 x number of activated features (RVA/RAP) x 24 x 365
Why does RAP need RVA?
Because RAP uses RVA to analyse the vulnerability that the attack is based on
3 locations to check consumption for RVA and RAP if you use DPS?
Account management
Data explorer
Environment API
How is KSPM licensed?
Host hours
2 types of SPM?
VSPM
CSPM
How is VSPM licensed?
CPU sockets per year
How is CSPM licensed?
host per year
A host in the CSPM context applies to what kind of resources?
compute, database, and function
What are users of the Security admin group allowed to do?
View and manage vulnerabilities if RVA is enabled and attacks if RAP is enabled
How can i fine tune permissions for users?
Assign view rights per environment or management zone
Which modules are affected if full stack monitoring is not used and why?
Code vulnerability and third party vulnerability because not sufficient environmental information, such as reachable data assets or public internet exposure
To detect third-party vulnerabilities in your environment what components are evaluated?
Software components
Runtime components
What attributes of the component or library are checked by application security?
Name and version
What providers are used for Third-party vulnerabilitie feed and how often are they checked?
Snyk and NVD (National Vulnerability Database)
Once every 5 min
For what kind of components is Snyk used for?
Software components (libraries)
Kube runtime components
For what kind of components is NVD used for?
Java runtime components
.NET runtime components
Node.JS runtime components
What is the resolution time for a Third-party vulnerabilitie?
2h
What could cause the resoultion of a Third-party vulnerabilitie? (5)
Affected process was stopped
Vulnerable component was updated or removed
App is not using the vulnerable component
After a restart there is no traffic to the app so the component doesnt load
Vulnerability has been fixed in the code
What is the severity of a code level vulnerability?
Critical
Resolution reasons for code level vulnerabilities? (4)
Has been fixed in the code
Has been fixed outside the app
Affected process doesnt receive any traffic
Affected process was stopped
How can you enable RVA on a more granular level?
enable/disable per supported technology
Overriding monitoring rules for third party vulnerabilities can be defined for which entity properties?
Host tag
Process tag
Management zone
From where and how can you enable RVA?
Enable RVA Application Security > Vulnerability Analytics > General settings.
Enable technology
Enable OneAgent feature flag code-level vulnerability evaluation
What does the name of a vulnerability contain?
Dynatace ID
Then depends on feed:
Snyk: Snyk ID
CVE:vulnerability id
CWE: vulnerability name
What are the 4 Risk assessment properties of a vulnerability?
Public internet exposure
Reachable data assets
Vulnerable function in use
Public exploit published
4 statuses of a vulnerability
Open
Resolved
Muted Open
Muted Resolved
7 reasons for a status change of a vulnerability
Opend or resolved
Muted or unmuted
The number of affected process groups has decreased or increased
The risk assessment has changed
The Davis Security Score has changed
The CVSS has changed
A new software component is detected
What are the 4 metrics based on which the DSS is calculated?
CVSS Score
Attack vector
Confidentiality
Integrity
Why is DSS more precise than CVSS?
CVSS assumes worst case scenario while DSS analyses the context as well based on public internet exposure and reachable data assets
6 types of entities that can be related to a vulnerability
App
Service
Database
Host
Kube cluster
Kube workload
What views is a MZ filter affecting on the vulnerability details page?
Related entities
Vulnerable components
How many MZ can be associated with a vulnerability at max?
1000
What are the 4 attributes of a recommendation from the security advisor?
Library that needs to be upgraded
Library tech logo
number of highest critical vulnerabilities solved
total vulnerabilities solved
What happens to existing vulnerabilities if you define a “do not monitor” rule that targets them?
They get “Resolved”
4 code vulnerabilities that Dynatrace detects and their context?
SQL Injection - SQL statement
Command injection - command
SSRF - request URL
Improper input validation - JNDI lookup name
When is an attack path shown?
When RVA is activated
When there are fewer than 500 attacks on a vulnerability
What does the attack path contain?
Source IP
Entry point
Vulnerability
Target
What are the 3 notification integrations for vulnerabilities?
Webhook
Jira
Email
When is a notification triggered?
Open resolved
New process group affected
What are the 6 properties of attacks that can be used when you define an allow rule?
Attacker IP
Attack type
Entry point payload
Entry point domain
Entry point port
Entry point path
What are the standards supported for SPM?
CIS
DORA
NIST
STIG
What is the component used to capture compliance data for SPM?
Kube Node config collector
How can i fix vulnerabilities in DT? (2)
Set up tracking links
Update version according to davis security advisor
Are restarts required for 3rd party vulnerabilities? If so, when?
No
Are restarts required for code level vulnerabilities? If so, when?
Yes.
Enable Global
Enable per tech
Enable OA feature
New monitoring rule
Are restarts required for attacks? If so, when?
Yes.
Enable Global
Enable per tech
Enable OA feature
New monitoring rule
How long are vulnerabilities stored?
365 days if resolved within a year
Next anniversary after resolution if resolved after a year
How long are attacks stored?
550 days
