Sqreen changelog www.sqreen.com

Few weeks ago, we released a very first iteration of the Application Security Risk details view.

While showing the mitigations Sqreen recommends to tackle the security weaknesses detected was great, it wasn't the best way to explore them.

This new iteration focuses on the weaknesses first which hopefully should help you understand what is wrong, and takes action.

As usual, we're eager to hear your feedback!

We improved the layout and overall look'n'feel of the Monitoring overview.

We're featuring the Application Security Risk, our latest addition so you can get the true gist of each app security at a glance.

The apps' stats (monitored requests, blocked attacks, malicious requests) are also back after having vanished for a couple of week.

XML External Entity (XXE) is a vulnerability impacting apps processing XML documents.

The vulnerability triggers when the XML input contains a reference to a malicious external entity because of a weakly configured XML parser. It may lead to data disclosure, denial of service, etc.

The OWASP 2017 Top Ten classifies this vulnerability as A4.

This protection is available to all PHP applications.

Protecting your users’ data and identity should be as critical as protecting your own data and business.

When your users are breached on other websites - probably not protected by Sqreen, it can often lead to them being easy targets on your own site, thanks to password reuse and such factors.

The best way to defend against this is to monitor such attacks using our built-in security module.

In the event that some of your users get compromised, you can now export the list and contact them ASAP or block their account until they have a chance to recover it.

This is only the first step. Our goal is to help you automate this process.

Review a demo ATO incident

Back at the end of last year, we introduced the notion of application security risk.

The risk rating, combined with the security flow map, has been designed to help you overview and prioritize where your focus and energy should better be spent, so you can prioritize where your focus and energy should be spent.

Now, you can review in details what made Sqreen think a given application is risky or not, and use these insights to mitigate some of the most critical risks.

We'll iterate a lot on this part in the coming weeks! Your feedback are more than welcome, as, as you’ll help us take this feature in the right direction.

Discover my apps' security risk https://my.sqreen.com/application/goto/application-risk

Up until now, deploying Sqreen on many applications was a tedious process. Basically, you needed to manually create the application from your dashboard and use a unique application token.

Meet the organization token! Using organization-based tokens, it's now 100 times easier to deploy Sqreen at scale. Just re-use the same token for all your applications and give them each a unique name.

For now, our Ruby, Node.js, and Go agents support organization tokens. PHP is coming up this week, and Python and Java are coming up next!

Obviously, the application token remains fully supported. When you feel ready to migrate, just fetch the token and update your app's configuration. Also, you can manage multiple tokens, if you want to segment deeper.

Fetch my organization token https://my.sqreen.com/profile/organization/tokens

Protecting your applications has been our #1 mission at Sqreen from day 1.

Thanks to your feedback, we managed to iterate a lot on this part, always aiming to increase the coverage and making things clearer and clearer about how and what Sqreen protects.

In our latest improvement, we totally revamped the way you can interact with all the protections Sqreen provides by merging them under high-level, value-oriented Security Modules.

We just released the Runtime Application Self Protection (RASP) module, which includes all the protection against the most critical vulnerabilities that you're already familiar with.

The scope of Sqreen’s protection for your apps should now be much easier to digest and to configure.

Review your apps' protection https://my.sqreen.com/application/goto/modules

Sqreen helps you monitor and protect your users since day 1.

From brute force attacks to credentials stuffing through an unusual volume of signups, we help you detect early on when your users may have been compromised and the attackers.

We revamped our heuristics so it's much faster, more accurate and you can decide to block attackers, like with any Playbooks. On top of that, you can fine-tune the threshold to customise for your context.

If you've already enabled User Monitoring, you have nothing to do. Otherwise, you may consider enabling it now! It takes only a few lines of code using our User SDK.

Start monitoring your users now https://my.sqreen.io/application/goto/settings/global

Sqreen is kind of a unique solution to app security.

There's now a lot going on, and discovering everything at once isn't always easy.

We've put together a nice getting started to help you discover the most important Sqreen benefits:

• Evaluate your apps' exposure
• Protect them against the most common threats
• Protect your users
• Protect your app's business logic

Whether you're new here (Welcome!) or already a seasoned Sqreen user, we strongly recommend you to take this tour to (re)discover our main features;

Get started

🎉Playbooks are now supported in Java: track custom events using Sqreen SDK and block or redirect attackers, without changing a single line of code.

Update your agent to version 1.1.0 and superior to get started!

Playbooks?

A few months back we released the Playbooks, helping you not only protect your apps against the most common web threats (SQL injection, Cross-site scripting, etc) but also against suspicious activities.

Now, we're providing you with some 20+ built-in playbooks.

Also, you can create your own custom ones, securing custom scenarios tied to your own business logic.

Discover the Playbooks