Traditional vulnerability management metrics such as the Common Vulnerability Scoring System (CVSS) score or the number of vulnerabilities are not enough to manage risks effectively. These metrics focus solely on vulnerabilities, ignoring other types of exposure that could be equally important, and prioritize remediation based on severity rather than contextual risk. To address these limitations, a more holistic approach to risk management is required that takes into account exposure insights, attack paths, and effective prioritization of remediation efforts.
The Inadequacy of Focusing Solely on Vulnerabilities
Vulnerabilities make up only a small portion of the attack surface that can be exploited by cybercriminals. Other risks, such as misconfigurations, overly permissive identities, and other security gaps, also play a role in exposing an organization to risk. Therefore, focusing solely on vulnerabilities is inadequate in managing overall risk, as other exposures also need to be considered.
Legacy Vulnerability Management Tools and The Challenge of Prioritization
Legacy vulnerability management tools were initially designed to meet compliance requirements rather than detecting sophisticated attacks. The legacy tools also had limitations in prioritization and often focused on vulnerabilities without considering other kinds of exposure that would change their remediation priority. Modern vulnerability management tools have started to address these limitations but still face significant challenges in prioritizing and addressing the limitations of legacy tools.
The Broader Scope of Exposures and Their Risk for Organizations
Exposures go far beyond typical CVEs and encompass a much broader spectrum of data breaches that could happen. Any weakness or susceptibility that can be exploited by an attacker could qualify as an exposure. Such exposures can be as simple as a password-protected file being shared with someone without proper clearance, or as complex as an attacker exploiting third-party APIs to attack an organization’s systems. This broader scope of exposures highlights the importance of identifying every possible security risk for a particular organization to minimize risks.
The Danger of Addressing Exposures in Isolation
Many security tools tend to focus on specific types of security breaches, such as vulnerabilities, misconfigurations, or identity theft, and address each one in isolation. This approach misses the fact that cybersecurity attacks typically target a combination of security breaches to be exploited. By addressing security breaches in isolation, an organization leaves itself open to attacks that could be prevented by addressing the broader underlying risks.
The Importance of Understanding the Context of Risk in Effective Security Management
Attackers do not exploit a single exposure or vulnerability in isolation, but rather leverage a toxic combination of vulnerabilities, misconfigurations, overly permissive identities, and other security gaps to explore attack paths. Effective security management requires a modern exposure management program that can combine multiple exposures and place them on an attack graph. Doing so enables an understanding of the context of risk with regard to critical organizational assets.
A Modern Approach: Exposure Management Programs
A modern exposure management program involves combining multiple exposures onto an attack graph to understand the relationship and context of risks towards critical assets.
The Three Key Pillars of a Modern Exposure Management Program
The three pillars for building a modern exposure management program are understanding exposure insights, analyzing attack paths, and prioritizing remediation efforts.
1. Understanding possible exposures
The first area to consider is understanding all of the possible exposures for a particular organization. An exposure register should be maintained that includes vulnerabilities, misconfigurations, overly permissive identities, and other security gaps so that risk can be identified and managed proactively.
2. Analyzing Attack Paths
Once exposures are identified, they need to be placed on an attack graph. The attack graph is a visual representation of all the different routes that an attacker can take to reach critical organizational assets. For instance, by analyzing what an attacker would need to attack a specific asset, the organization can identify those potential exposures along the path that leads to that asset.
3. Prioritizing remediation efforts
Prioritizing remediation involves looking at the risk context that the exposure presents and the potential for a devastating attack. Rather than relying on severity-based vulnerability categorizations, using risk reduction to determine remediation priority will ensure that the critical exposures are addressed first.
Continuous Monitoring for Scalable Risk Management
By continuously monitoring exposures, organizations can build a sustainable and scalable process for managing risk over time. Such supervised monitoring will ensure that new exposures are found and ranked appropriately in the exposure register, and remediation efforts are properly aligned to ensure continued and stable reduction in cybersecurity exposure.
By combining these three pillars, organizations can build a comprehensive and effective exposure management program that helps protect critical assets and reduce overall risk exposure. Focusing on exposure management will ensure that organizations have a proactive risk management program that considers the context of the exposures before making decisions on remediation priorities. Addressing any exposure in isolation will make an organization more susceptible to cybersecurity breaches. Effective cybersecurity requires a comprehensive and holistic approach that leverages the three pillars of exposure management.