Introduction to Posture Management (SSPM)

Overview

The Grip Posture Management module is designed to identify and address security gaps in your organization's most critical application configurations.

It provides a comprehensive view of app security posture, highlighting misconfigurations, prioritizing critical gaps, and offering mitigation steps. The module proactively minimizes risk by continuously monitoring app configurations and ensuring alignment with security best practices and compliance requirements.

SaaS Security Posture Management page

Click on “Posture” from the navigation bar.

The “SaaS Security Posture Management” page has two tabs, “Overview” and “Manage.”

The “Overview” page functions as the SSPM dashboard and includes quick-view graphs that give you a snapshot of your SSPM status.

• Pie for the pass/fail policies (1)

• A quick overview of your lowest-scoring connected tenants for prioritized remediation (2)

• SSPM Compliance (3) provides an overview of the compliance framework for your mapped applications.
  Note that policies requiring manual review will be listed in gray.

Hovering over the graphs displays the exact number of policies.

• Scrolling down, you'll see the default view of the failed policies that need your attention the most across all connected tenants (4).

On the “Manage” tab, you will see the list of Tenants and applications you added to your posture management.

Clicking on a Tenant will open it and enable you to view and manage its policies.

• Use the top filters (1) to filter the policies by Severity and Status, or to view them all

• Use the column headers to sort the information (2)

• In case the tenant has multiple modules, you can see and sort them under the module column (3)

• In the “Status” column (4), you will find whether the policy has “Passed” or “Failed.”
  Sometimes, when Grip cannot assess the policy via API, you will see an “Undetectable” status.

• Policies are updated daily. The last update time is displayed at the top right. To perform a manual sync, click on “Sync Policies Status.”

• To view policy details and perform actions, click on it.

• Under the “Overview” tab, you will see the policy description “Recommended actions” in case this policy is in “Fail” status.

• For O365, GW & Okta Policies, you will find the corresponding controls from NIST 800-53 Rev. 4 and NIST CSF Rev 1.1.

Click the dropdown to edit the policy “Status” (5) and “Severity” (6) levels.

When changing a policy’s “Status” or “Severity,” you can add a comment describing the reason for the change (7).
Note that both can be undone by clicking the “Revert” icon (8).

Clicking “Revert” will change the policy status to the latest automatically detected status

Mitigation steps

• Under the mitigation steps tab, you'll find recommended recovery actions designed to help you address the risk.

• Mitigation steps are currently available for Office 365 (O365) and Google Workspace (GW).

Forward failed SSMP policies to application owners for resolution.

If you do not own the app with the failed policy, you can request that the owner review and resolve the issue that caused it to fail.

Click on the policy and then on the “Send Request” button.

• Select the contact to whom you want to send the policy. This can be the primary contact, power user, first known user, or any other contact you choose.

• Click “Send.”

The recipient will receive an email from Grip requesting a review of a “misconfiguration in the app."

The email will also include recommendations for resolving the issue.
Policies that require a manual review include a web form where the app admin can indicate the policy's status and provide an auditable comment.