With a big bang, we're happy to announce our first major product release for 2022!
Phishing & Awareness Training
In this release, we are bringing the first of many larger improvements to Phishing & Awareness Training which will, in the end, bring a set of new features for awareness training to our customers.
Below we're listing some highlights that come out in this release:
- Schedules have been merged into assessments, creating one surface to overview and manage all your assessments. We have enhanced the number of filtering and data points available on this page.
- The education section in assessments has been renamed to "Awareness training".
- The send out section has been renamed to "Phishing send out".
- Assessment results have been moved as a new sub-page "Results" to "Recipients".
- Recipient severity is now visualized in an in-page widget and the column is also sortable to easily identify the riskiest recipients.
Other improvements:
- Sorting on the number of education emails.
- Improved performance of larger send-outs and severity ordering on the recipient page.
- Assessments can now be cancelled.
- The sender email domain is now completely customizable.
- Phishing & Awareness Training dashboard widget now aligns its filtering options across Security Center.
- Performance of larger send-outs to handle more recipients in the same assessment.
We are coming out with more fantastic features within Phishing & Awareness Training in upcoming March releases, so stay tuned!
CIS benchmarks accuracy improvements
As Holm Security is a certified vendor of the Center for Internet Security (CIS), we include product features to perform Policy scanning using CIS benchmarks. On an ongoing basis, we are performing certifications for new benchmarks that we implement support.
In this product release, we have updated the benchmarks of our existing benchmark templates including improved accuracy for scan results. This includes Debian 9, CentOS 8, and many more that are currently visible in Security Center.
Improved default account settings changes
These changes are impacting new accounts and profiles that are created. They do not impact existing accounts.
- Scanning of sensitive content is now disabled by default for web scan profiles.
- Network scans are now closing vulnerabilities by default when a host changes state from active to inactive.
- Network scan profiles now have "Perform ICMP" ping disabled by default.
Content Security Policy for web scans
Content Security Policy (CSP) acts as a defense mechanism against cross-site scripting (XSS) attacks and similar vulnerabilities. A misconfigured CSP header or an overly permissive directive from the CSP may allow an attacker to evade from browser’s protection mechanism and carry out the attack.
Our web scan engine (version 2) now supports identifying weaknesses related to CSP when scanning target web systems.
General improvements
- The first and last detection dates in reports are now accurate when grouping by assets.
- Customers can now jump to vulnerability details directly from viewing a Device asset in Asset Manager.
- PCI DSS ASV reports now store the entered company name properly when editing the report.
- Fixed issue with web scan profile and saving when Malaysian social security number detection was enabled.
- User roles and permissions have received several improvements.
- The next run date for scan schedules is now correctly calculated among timezones.
- In certain cases, dynamic tags for assets were saved incorrectly as a static tag which is now handled correctly.
- Policy scans have received improved error messages to easier understand the reason for a possible failure.
- Resolved issues when using tags and network assets inclusions in remediation policies.
- Charts now display the value of data points without the need to hover on them.