Why Is Exposure Management Critical In Securing The Modern Attack Surface?

As of 1st October 2022, 72% of organisations are still vulnerable to the Log4Shell vulnerability. And Log4Shell was one of many critical security risks that organisations had to manage in 2022. Macroeconomic shocks brought on geopolitical uncertainties, skyrocketing inflation and supply chain disruptions resulting in a surge in ransomware attacks. But most disconcerting of all was the fact that legacy vulnerabilities from years ago were still being exploited.

When cyberattacks occur, it is easy to point the righteous finger at security practitioners for not being able to prevent the attack in the first place. The reality is that security teams are often inundated with numerous point tools, each performing a separate function and generating siloed data. Adding to this conundrum of how to make sense of all the data is miscommunication from third-party vendors and a lack of timely patches. Breaking down silos to obtain a holistic view of the modern attack surface requires exposure management where risk reduction can be anticipated, quantified and communicated accurately.

Securing the modern attack surface with exposure management

Unsplash/Representational Image

According to PwC¡¯s global Digital Trust report, organisations in India are bracing for a catastrophic cyberattack. A vast majority (77%) of organisations in the country say the threat from cybercriminals is the biggest concern, yet less than 40% say they have fully mitigated emerging cyber risks. Indian organisations have increased investments towards cybersecurity and adopted technologies to combat threats from various ends, the report states, so why is it that cyberattacks continue to make headlines?

The fundamental reason is that products put in place to make sense of cybersecurity are often reactive and not preventative enough. For instance, extended detection and response (XDR) systems collate data from multiple point tools to identify attacks as and when they occur. While this may speed up incident response, it does not amount to preventing attacks. Focusing on identifying attacks as soon as they occur doesn¡¯t present a complete picture of the modern attack surface, let alone the organisation¡¯s security posture.

Security teams are faced with an overload of data, which many organisations ultimately dump into a spreadsheet to analyse. For instance, a specific security tool in use may only identify misconfigurations in the cloud while another only aggregates vulnerability data. The data generated by each of these tools don¡¯t necessarily identify which vulnerabilities to prioritise. What organisations need is the ability to assess the efficacy of their cybersecurity programmes and build a complete picture of their cyber exposure.

Unsplash/Representational Image

But are any of these tools successful in helping organisations actively reduce risk? Not really. And the reason is that existing security tools address a limited scope of a problem that is much larger. To effectively assess your security posture you need a more nuanced approach. It requires collecting data from a range of tools and analysing it to capture the full breadth of an organisation¡¯s environment. Exposure management represents a complete shift in how we view cybersecurity. Currently, most organisations have a specific tool for various security needs and what¡¯s missing is context. Exposure management does just that ¡ª it provides organisations with the ability to view the entire attack surface, detect the attack pathways cybercriminals could take and identify the most critical assets exposed.

Unsplash/Representational Image

With exposure management, organisations can see all of their software vulnerabilities and misconfigurations, as well as who is using which systems and what level of access they have, all in one platform. For instance organisation ¡®X¡¯ has multiple devices in use. And among them, two laptops have the worst vulnerabilities. When viewed through silos, it would be reasonable to assume vulnerabilities on both laptops need to be patched. What¡¯s missing here is the knowledge of whether the organisation is really at risk and which laptop to fix first. If organisations could identify that one device belongs to a user with admin access and is not using multi-factor authentication, and the other belongs to a front desk employee without admin access, it becomes clear which device and vulnerability to prioritise.

pexels/Representational Image

Exposure management correlates, measures and prioritises data from preventive security tools and it also helps organisations effectively reduce risk over time. It helps organisations understand the breadth of the attack surface with visibility into assets that are outside of the IT infrastructure like OT systems, cloud instances and internet-facing systems and apps. It gives security teams an understanding of the depth of the attack surface with visibility into users, level of access and privileges, and the potential attack pathways across the organisation.

An ever-evolving attack surface and increasingly persistent threat actors require a fundamental shift in cybersecurity ¡ª just what exposure management provides. With this approach, prioritising cyber security efforts becomes clear, concise, and meaningful, helping organisations accurately quantify and reduce risk.

The writer is Country Manager, Tenable India.