Dynatrace Application Security extends automatic vulnerability management to .NET

Dynatrace extends the coverage of its Application Security module to .NET applications. It provides automated runtime vulnerability detection and AI-powered risk assessment for cloud-native applications across the entire software development lifecycle. This enables DevSecOps teams to react quickly and ensure the security of digital services and business-critical applications.

We recently announced expanded Dynatrace cloud application security coverage for the Kubernetes platform and Node.js. Now, with the latest addition to the Dynatrace Application Security module, Dynatrace provides automatic vulnerability management for .NET applications.

What is .NET?

.NET is a popular open-source developer platform with an estimated 5,000,000 developers and 100,000 open-source contributors. And because .NET supports containers, auto-scaling, and serverless computing, there has been a resurgence of interest in this platform. In fact, we see a lot of .NET usage amongst our customers.

Many enterprises have successfully made the transition to cloud-native technologies and now use Kubernetes or OpenShift. The .NET platform is widely used for these modern workloads and their core infrastructure is written in it. In particular, companies that run their applications on Azure Cloud are interested in .NET because more than 100 Azure services support .NET natively. While the adoption of open-source, third-party libraries and cloud-native platforms accelerates innovation and time to value, it also creates new security challenges. Preventing, identifying, and resolving security exposures is, therefore, a top concern for businesses.

Security teams need automation to manage application security

Traditional approaches to application security can’t keep up with continuously changing multicloud environments. Cloud complexity and the frequency at which new code is pushed into production can lead to blind spots and uncertainty about potential security exposures and their impact on key business services and applications. At the same time, companies have a hard time establishing common security standards across multiple teams working on cloud workloads. As a result, DevSecOps teams are required to prevent, detect, and resolve exposures but the speed of innovation and the number of alerts can quickly become unmanageable. This can lead to challenges such as:

• Security teams becoming overwhelmed by the high number of vulnerabilities that they need to manage manually across heterogeneous environments.
• Lack of common security standards for teams working on cloud workloads.
• The inability of Dev teams to assess which vulnerabilities present the highest risk.
• Alerts being ignored or turned off because they’re assumed to be false positives or have a low risk.

Automation is therefore critical to giving DevOps teams more time for innovation while giving security teams confidence that newly released cloud-native applications and services are vulnerability-free. Such automation requires a new approach to application security, which is why Dynatrace introduced automated runtime vulnerability detection and AI-powered risk assessment for cloud-native applications across the entire software development lifecycle.

Dynatrace Application Security provides full-stack automatic vulnerability management, now extended to .NET

Dynatrace now extends security coverage to .NET applications by identifying runtime vulnerabilities in dynamic cloud-native production and pre-production environments. This complements the recent enhancements made to the Application Security module with automatic vulnerability management for Kubernetes, Node.js, and Java.

With precise, real-time, topology-driven risk assessment, you can focus your energy where it matters for your business and eliminate time wasted on false positives. This dramatically reduces remediation time. It also allows you to:

• Understand true risk—Eliminate false positives and Dev team distractions with intelligent runtime analysis, filtering, and automatic prioritization. Risks are prioritized by data access path and actual production execution while impacted service flows are highlighted automatically. You can fix high-priority vulnerabilities first, such as the risk of sensitive data access and more.
• Eliminate blind spots—It’s key to have full visibility into everything from pre-production to production. Now, you can leverage observability information that includes insights into what’s happening inside your .NET applications and within your production environment. You can also get insights into individual requests and drill down to individual transactions to understand exactly what happened during a user session and how to resolve issues quickly.
• Quickly understand the urgency of a vulnerability—What is the Common Vulnerability Scoring System (CVSS) score? Is this score published on the public internet? Is sensitive data affected? Which entities are affected? Dynatrace automated runtime vulnerability detection helps you understand each risk quickly and thoroughly, allowing you to accurately prioritize which vulnerabilities to fix first.
• Track the evolution of a threat—We’ve simplified vulnerability management by providing a closed feedback loop, automatically opening a security ticket whenever a vulnerability is detected, providing real-time insight into the status of the issue during remediation, and closing the ticket once the issue is resolved. So your DevSecOps team no longer needs to manually create, track, and verify the evolution of identified vulnerabilities between build scans.
• All-in-one platform—Ensure consistency across all environments with a single click, whether it’s Kubernetes, Node.js, Java, or .NET. The Dynatrace Application Security module provides automated runtime vulnerability detection and risk assessment for cloud-native applications across the entire software development lifecycle, in every operating environment. Dynatrace Application Security builds on the strengths of our patented OneAgent technology which provides code-level insights down to individual transactions with virtually no overhead.

Next steps

All Dynatrace Application Security enhancements mentioned in this blog post will be available within the next 90 days.

• If you are a Dynatrace customer and want to start using the new Application Security module, go to the Dynatrace web UI and select Vulnerabilities in the menu.
• If you’re not using Dynatrace yet, it’s easy to get started in under five minutes with the Dynatrace free trial.
• For more information, visit our website to watch the demo, read this Application Security blog post, or visit Dynatrace Documentation.