Time To Get Serious About Defence

Uploaded on 2023-11-08 in TECHNOLOGY--Resilience, FREE TO VIEW

When we think of the modern attack surface it is a mix of on-premises and multiple cloud systems, numerous identity and privilege management tools and multiple web-facing assets. The challenge with complexity is that it affords numerous opportunities for misconfigurations and overlooked assets. And threat actors are taking full advantage of the blindspots.

A commissioned study of 100 U.K. based cybersecurity and IT leaders, conducted in 2023 by Forrester Consulting on behalf of Tenable, found that the average organisation was able to prevent 52% of the cyberattacks they encountered in the last two years. However, having only this much coverage left them vulnerable to 48% of the attacks faced, with security teams forced to focus time and efforts reactively mitigating rather than preventing attacks. Looking at what’s holding the teams back from switching focus, it was evident that time is not on their side.

Six in 10 respondents (60%) say the cybersecurity team is too busy fighting critical incidents to take a preventive approach to reducing their organisation’s exposure.

Consider the large percentage of successful ransomware attacks in the UK this year alone. Capita, an outsourcing company that runs crucial services for local councils, the military and the NHS, had its systems infiltrated by a ransomware gang with customer data exfiltrated. Royal Mail held its hands up, finding itself unable to process international deliveries in addition to its data held to ransom. Barts Health NHS trust, Greater Manchester Police and more all disclosed that they’d been impacted by ransomware. The days of old where threat actors were indiscriminately encrypted systems for a fraction of a bitcoin are over as today’s cyber criminals will cripple operations and negotiate a sizable fee for the return to normal.

Once sensitive data has been stolen in an attack the confidence of confidentiality is lost forever - you can’t put the data genie back in the bottle - that’s why a proactive approach is so important.

Attack Paths

When it comes to cyberattacks, what we know is that threat actors’ attack methodology is not advanced or even unique but opportunistic. Attackers see many ways in and multiple paths through environments to do damage and monetise their nefarious efforts. When evaluating an organisation’s attack surface, they're probing for the right combination of vulnerabilities, misconfigurations and identity privileges. They’re looking for an open window to crawl through. In the majority of instances it is a known vulnerability that allows threat actors an entry point to the organisation’s infrastructure. Having gained entry threat actors will then look to exploit misconfigurations in Active Directory to gain privilege and further infiltrate the organisation to steal data, encrypt systems or cause other business impacting outcomes.

Protecting everything is soul destroying given it's practically an impossible task. Similarly, organisations are well beyond the point where vulnerability management can be performed in a vacuum. Alone, it only tells part of the story. By focusing resources on the vulnerabilities that are likely to be exploited and understanding how attackers chain multiple flaws together, security teams can design more complete strategies for reducing their overall risk and exposure.

Prevention Is Better Than Cure

Preventive cybersecurity requires the ability to assess and prioritise vulnerabilities and misconfigurations in context, wherever they reside, alongside user data, asset value and awareness of likely attack paths so that IT and cybersecurity employees can make the right decisions about which systems or classes of users and assets to remediate first.

Built on the foundations of risk-based vulnerability management, exposure management takes a broader view across the modern attack surface, applying both technical and business context to more precisely identify and more accurately communicate cyber risk, enabling better business decisions.

An exposure management program provides additional context - such as who is using the system, what they have access to, how it's configured, etc. Understanding attacker behaviour helps inform security programs and prioritise security efforts to focus on areas of greatest risk and disrupt attack paths, ultimately reducing exposure to cyber incidents.

Organisations that can anticipate cyber attacks and communicate those risks for decision support, will be the ones best positioned to defend against emerging threats.

Implementing an exposure management program enables security professionals to better allocate time and resources so they can focus on taking the preventive actions that legitimately reduce an organization's cyber risk.

Gavin Millard is Deputy CTO at Tenable

Image: Rodion Kutsaiev

You Might Also Read:

Senior Managers Need Higher Cyber Security Awareness Than Other Employees:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.