@olaf_becker4CEO & Founder, LSE GROUP CORPORATION
Shipped: CenTest
CenTest is a monitoring and penetration-testing platform for security teams. Lightweight Go agents run scheduled and on-demand scans across customer networks and report back over encrypted gRPC, so findings reach the dashboard without opening inbound ports. [Who uses it, e.g. “Built for MSPs and in-house security teams.”] [One number, e.g. “Averages X hosts scanned per run, with alerts in under Y minutes.”]
Agents
Comments3
Outbound-only gRPC from the agent is a clean answer to the inbound-port objection MSPs raise. The harder part is probably scan authorization, since pen-test traffic from inside a customer network can trip their EDR. How do you handle scope approval and EDR allowlisting during beta?
You've put your finger on the harder problem, Ryan. Outbound-only gRPC removes the inbound-port objection, but it doesn't make the scan traffic any less noisy to an EDR. Authorization comes first. [Describe what happens today, e.g. "No scan runs until the customer has defined its target ranges and confirmed it's authorized to test them. Agents only scan what's in that approved scope."] For EDR, we ask beta customers to allowlist the agent's host and its source address ahead of time. That way scan traffic is expected and alerts can be attributed to it. [Adjust to what you actually do, e.g. a published list of agent binaries, hashes and source IPs.] We'd rather have the customer's security team know in advance than have a scan look like an intrusion. Beta is where we're learning which EDRs react to what, so I'd welcome specifics if you've run into this on the MSP side.
It is a huge one here. I will check it out
3 comments
Outbound-only gRPC from the agent is a clean answer to the inbound-port objection MSPs raise. The harder part is probably scan authorization, since pen-test traffic from inside a customer network can trip their EDR. How do you handle scope approval and EDR allowlisting during beta?
You've put your finger on the harder problem, Ryan. Outbound-only gRPC removes the inbound-port objection, but it doesn't make the scan traffic any less noisy to an EDR. Authorization comes first. [Describe what happens today, e.g. "No scan runs until the customer has defined its target ranges and confirmed it's authorized to test them. Agents only scan what's in that approved scope."] For EDR, we ask beta customers to allowlist the agent's host and its source address ahead of time. That way scan traffic is expected and alerts can be attributed to it. [Adjust to what you actually do, e.g. a published list of agent binaries, hashes and source IPs.] We'd rather have the customer's security team know in advance than have a scan look like an intrusion. Beta is where we're learning which EDRs react to what, so I'd welcome specifics if you've run into this on the MSP side.
It is a huge one here. I will check it out