Closing Often Missed Vulnerabilities that Leave Organizations Exposed
•Download as PPTX, PDF•
1 like•10 views
This document outlines an agenda for a presentation on closing often missed vulnerabilities. The presentation will discuss understanding IT and security posture, the state of vulnerability management and security hygiene, challenges faced by security and IT teams in keeping up due to expanding attack surfaces. It will also discuss security strategies and the threat funnel approach of protect, detect, respond and recover. Finally, it will discuss a new innovation from SecPod called SANERNOW that aims to enable continuous posture anomaly management through automated identification and remediation of outliers.
Recommended
Recommended
More Related Content
Similar to Closing Often Missed Vulnerabilities that Leave Organizations Exposed
Similar to Closing Often Missed Vulnerabilities that Leave Organizations Exposed (20)
More from SecPod
More from SecPod (17)
Recently uploaded
Recently uploaded (20)
Closing Often Missed Vulnerabilities that Leave Organizations Exposed
- 1. Closing Often Missed Vulnerabilities that Leave Organizations Exposed
- 2. © 2023 TechTarget, Inc. All Rights Reserved. 2 Speaker Introductions Chandrashekhar B SecPod Founder, CEO Dave Gruber ESG Principal Analyst Preeti Subramanian SecPod Chief Product Architect
- 3. © 2023 TechTarget, Inc. All Rights Reserved. 3 Today’s Agenda • Understanding IT and Security Posture • State of the Industry • Keeping up with a Growing Attack Surface • Security Strategies and the Threat Funnel • New Innovation from SecPod • Q&A
- 4. © 2023 TechTarget, Inc. All Rights Reserved. What is IT Security Posture? The security status of an enterprise’s networks, information, and systems based on information security resources (e.g., people, hardware, software, policies) and capabilities in place to manage the defense defense of the enterprise and to react as the situation changes. • Networks • Information • Systems • InfoSec resources (people, hardware, software, policies) • Defense management capabilities
- 5. © 2023 TechTarget, Inc. All Rights Reserved. 5 Security Hygiene and Posture Management Remains One of the Least Mature Areas of Cybersecurity Organizations Believe Their Vulnerability Management Programs Are Mature, but there Is Still Work to Be Done External Attack Surface Management is Helping Expose Risk, but Lacks Automated Remediation Progress is Underway Adding Risk into the Security Equation,, but Point-in-time, Static Assessment Struggles to Tell the Real Story Asset Management is a Priority, but Depends Upon Tools, Processes, and Cross Department Cooperation for Most Many Siloed Posture Management Activities are Underway, with Opportunity for Convergence State of Security Hygiene and Posture Management
- 6. © 2023 TechTarget, Inc. All Rights Reserved. 6 Question text: Approximately how often does your organization conduct each of the following activities across all targeted/applicable assets? (Percent of respondents, N=398) Frequency of Security Hygiene and Posture Management Tasks 21% 22% 24% 25% 25% 27% 31% 38% 41% 34% 32% 35% 32% 38% 37% 32% 36% 30% 23% 26% 25% 23% 20% 22% 23% 15% 17% 14% 12% 12% 14% 11% 10% 10% 7% 9% 6% 7% 2% 5% 3% 2% 2% 2% 2% 1% 1% 1% 1% 1% 2% 1% 1% 1% 1% 1% 1% 1% 1% Compliance and governance reviews Asset inventory review Reviewing risk exceptions, CVEs and other risk items that have been “accepted” and not fixed Asset/configuration management review Reviewing controls effectiveness including performance of deployed security tools and processes Access control review Data discovery and classification Vulnerability scans Application security scans 0% 20% 40% 60% 80% 100% Daily Once per week Once per month Once per quarter Once per year Less often than once per year Don’t know Most activity is event-based
- 7. © 2023 TechTarget, Inc. All Rights Reserved. 7 Security and IT Teams are Struggling to Keep Up © 2023 TechTarget, Inc. All Rights Reserved.
- 8. 8 More Than Half Think Security Operations is More Difficult Today vs. Two Years Ago 5 Top Reasons Why 1. Growing attack surface 2. Threat landscape 3. More cloud and SaaS usage 4. A growing number of security tools 5. Firefighting leaves no time to improve the program The Expanding Attack Surface Creates More Challenges 1. More Vulnerabilities to Manage 2. Current Tools are Failing to Support Expanding Attack Surface 3. Modern Applications Development and Deployment has Increased Velocity, Requiring New Skills 2022 ESG Research: SOC Modernization and the Role of XDR
- 9. 9 47% 42% 7% 3% 1% We have a mature vulnerability management program in place, remediating vulnerabilities within 30 days of identification We have a formal vulnerability management program, but we have gaps in parts of our core infrastructure We have a formal vulnerability management program, but we are generally slow to remediate issues Our vulnerability management program is implemented in regular maintenance windows only, unles critical Don’t know Question text: How would you describe your organization when it comes to identifying and patching software and configuration vulnerabilities? (Percent of respondents, N=620) Half Report Suboptimal Vulnerability Management Programs 52% Top Ransomware 4 Entry Points 2022 ESG Research: The Long Road Ahead to Ransomware Preparedness
- 10. © 2023 TechTarget, Inc. All Rights Reserved. 10 Biggest Vulnerability Management Challenges
- 11. © 2023 TechTarget, Inc. All Rights Reserved. Monitoring Your Attack Surface Your attack surface = the sum of all exposed IT assets across all attack vectors. oThe entire area of IT infrastructure that is susceptible or exposed to potential compromise. oProtecting an organization requires careful review of every attack vector, and a detailed understanding of all assets associated with every attack vector, and what vulnerabilities exist within them.
- 12. Attack Surface Management (Asset discovery, Vuln Assessment, Vuln Remediation..) Active Security Controls (Network, Endpoint, Cloud, Email, Identity, Backups..) Detection & Response (EDR, NDR, XDR, ITDR..) Incident Response Recovery Security Strategies & The Threat Funnel PROTECT DETECT RESPOND RECOVER IDENTIFY
- 13. Attack Surface Reduction (Asset discovery, Vuln Assessment, Vuln Remediation..) Active Security Controls (Network, Endpoint, Cloud, Email, Identity, Backups..) Detection & Response (EDR, NDR, XDR, ITDR..) Incident Response Recovery Security Strategies & The Threat Funnel PROTECT DETECT RESPOND RECOVER IDENTIFY Major Shift to Behavioral Threat Detection Monitoring
- 14. Attack Surface Reduction (Asset discovery, Vuln Assessment, Vuln Remediation..) Active Security Controls (Network, Endpoint, Cloud, Email, Identity, Backups..) Detection & Response (EDR, NDR, XDR, ITDR..) Incident Response Recovery Security Strategies & The Threat Funnel PROTECT DETECT RESPOND RECOVER IDENTIFY Continues to Lag, Primarily Using Static, Event-based Approaches
- 15. 15 Modernization is Needed to Bring the Top of the Threat Funnel into Alignment © 2023 TechTarget, Inc. All Rights Reserved.
- 18. Software Hardware WHAT IT SECURITY TEAMS HAVE TODAY VS WHAT THEY CAN HAVE
- 19. ONE ON ONE LABORIOUS ASSESSMENT VS. HOLISTIC ASSESSMENT IDENTIFYING OUTLIERS
- 20. SECPOD’S INVENTION TO MANAGE POSTURE ANOMALIES WORKSTATIONS SERVERS VIRTUAL DEVICES ALL MAJOR OSs NETWORK DEVICES Enterprise IT Infrastructure Continuous Data Feed Posture Anomaly Reporting Interface Remediation Fixes Posture Anomaly Controls & Trends POSTURE ANOMALY ANALYSIS ENGINE Outliers Detection Rule Based Data Trend Based Security Control Deviations Big Data Store User Inputs For Configuration and Whitelisting Feedback
- 21. Posture Anomaly Computation Framework
- 22. SECPOD’S INVENTION TO MANAGE POSTURE ANOMALIES SANERNOW CONTINUOUS POSTURE ANOMALY MANAGEMENT (CPAM) TOOL
- 23. BENEFITS OF CPAM TOOL Gain Rapid Security Mileage Improve Operational Efficiency Eliminate Hidden Uncertainties Take Control over Anomaly Loopholes
- 24. For inquiries, contact us at: Email: info@secpod.com WWW.SECPOD.COM PREVENT CYBER ATTACKS. CONTINUOUS. AUTOMATED. TRY SANERNOW FREE
Editor's Notes
- As the 2023 outlook shifts security program investment strategies, security teams face continued headwinds induced by the expansion and diversity of the attack surface that they are defending, a more advance threat landscape, and a generally more complex environment – both in what needs to be secured and the number of tools needed to do so. Underlying these challenges is the shift to cloud and as-a-service type IT infrastructure, requiring an upgrade to skills, processes, and security tools. Attack surface exposure begins with risk assessment and vulnerability management, which is further complicated with additional cloud investments.
- Here we see that more than half recognize weaknesses in vulnerability management programs, adding risk.
- The term attack surface is often confused with the term attack vector, but they are not the same thing. The surface is what is being attacked; the vector is the means by which an intruder gains access. Your attack surface is the totality of all vulnerabilities in connected hardware and software. The combination of all attack vectors and all vulnerable assets within them is known as an organization’s attack surface. Attack vectors Specific paths that attackers use to gain unauthorized access to your environment. A simple analogy would be leaving a door or window to a building unlocked or open. While not always exploited, these openings provide an opportunity for unauthorized entry and therefore creates risk for malicious or unwanted activities that may take place. Common cyber-attack vectors include firewalls, DDoS attacks, malware, passwords, misconfigured APIs, and phishing – however organizations often have 100 or more attack vectors, adding lots of opportunity for risk. Protecting an organization requires careful review of every attack vector, and a detailed understanding of all assets associate with every attack vector, and what vulnerabilities exist in them. The combination of all attack vectors and all vulnerable assets within them is known as an organization’s attack surface. Your attack surface therefore reflects the entire area of IT infrastructure that is susceptible or exposed to potential compromise.
- Thinking about security in the context of proactive and reactive strategies, I’m using a relatively simple threat funnel diagram to depict our ability to defend against the threats aimed at our organization. Reactive strategies are typically more human-intensive activities, as shown with the stick figures on the right. So, in a world of hiring constraints, we may want to over-rotate investments toward proactive strategies that can optimize the use of the few security resources we have. This doesn’t eliminate reactive strategies, but can reduce them.
- Thinking about security in the context of proactive and reactive strategies, I’m using a relatively simple threat funnel diagram to depict our ability to defend against the threats aimed at our organization. Reactive strategies are typically more human-intensive activities, as shown with the stick figures on the right. So, in a world of hiring constraints, we may want to over-rotate investments toward proactive strategies that can optimize the use of the few security resources we have. This doesn’t eliminate reactive strategies, but can reduce them.
- Thinking about security in the context of proactive and reactive strategies, I’m using a relatively simple threat funnel diagram to depict our ability to defend against the threats aimed at our organization. Reactive strategies are typically more human-intensive activities, as shown with the stick figures on the right. So, in a world of hiring constraints, we may want to over-rotate investments toward proactive strategies that can optimize the use of the few security resources we have. This doesn’t eliminate reactive strategies, but can reduce them.
- Let’s look closer are strategies that can help us fight back.
- Ouliers, rules, data trends, deviation from standard configurations