Never Let a Security Analyst Do a Machine’s Job - TCO calculator

Tools used here are usually inexpensive or open source like Shodan or Censys, or security rating services like BitSight and SecurityScorecard. Optimally, you would want these tools to automatically feed an asset management database, but that level of sophistication is sorely lacking in this area. Maybe we’ll talk more about automation and orchestration for external asset management in another blog…

Security Test All The Things

The next thing to figure out is the cost to test “all the things” found during discovery. This is different from testing all the things you know about now or even testing the things you think are important with a really expensive penetration test... run once, by folks who wear black hoodies and talk a lot about cryptocurrency. We can use your answers to the “smaller questions” to estimate your current expenditures for vulnerability scanning and penetration testing, both generally focused on alive IP addresses only.

We can put more solid numbers to the assumptions about your total costs for these functions if you have your actual hourly labor rates, but it’s generally a good rule of thumb to know that the minimum cost for basic penetration testing of a single IP is more than $480 each time it’s checked. A vulnerability scan for the same asset is many orders of magnitude less expensive, but still not negligible at $0.10 to $1.00 per asset scan. It's that high because you probably aren’t using your vulnerability scanners every week, or even every month, and whatever results come out will need to be validated by someone. The manual effort to pull together all of these results from the different solutions (pen testing, vulnerability scanning, etc.) is laborious and time consuming, and your team is likely further supplementing that data with threat intelligence data feeds to try to get a better sense of just how to prioritize each of the hundreds of critical CVSS scores (i.e., scores of 10) in your attack surface to decide what your security operations and IT teams will be fixing first.

Finally, Do Something

So, you’ve discovered things. And tested things. And all those tests have uncovered attack vectors, like vulnerabilities, misconfigurations, unattended assets, unused domain space, expired certificates, or a number of other problems that surface in IT systems as they age on the internet, waiting for someone to use them for nefarious activities. It’s time to do something about these issues.

We need to take into account that your team will be prioritizing, validating, and reporting on everything that is found and fixed to provide metrics on a job well done. Tools typically associated with this are IT service management software like ServiceNow or ZenDesk and analytics tools like with Splunk or Kenna. There are a myriad of processes involved in moving from issues identified in the attack surface to actually acting on the problems. The bottom line is that, manually, a critical issue is going to require at least 16 hours to go from an open issue to a validated fix. And that is very optimistic without mentioning the cost of re-testing.

So let’s do a little back-of-the-napkin math. If a $40,000 penetration test requires a month to generate a list of 20 issues on a cluster of 10 web applications, your team is paid at a total loaded cost of $85/hour, and it takes only 16 hours per issue (320 hours) to fix them all, then your TCO for that method of detecting, prioritizing, and validating is $40,000+(320*$85)+$40,000. Or $107,200. Or $5,360 per issue. You might be saying, “But, Jim, you have $40,000 in there twice!” Right, because once you’ve fixed the issue, to really know it’s gone you need to validate the issue isn’t there presumably in the same way you identified it. On the other hand maybe you only run 25% of the previous testing, honed on the fixes...you are still out $77,200 or $3,860 per issue.

And do you have an idea of how many issues you would likely identify per year? How about how many of those issues you need to fix? Our research shows that a well-tended attack surface can have as few as 0.01% assets with critical issues per year, while a more unmanaged attack surface can see something like 5.2%, so the range is quite large. These percentages aren’t large, but if there are 1,000 assets, that is still as many as 52 critical issues per year. And organizations with $1B in revenue and above having over 150,000 assets recognize that any efficiencies they can gain in detecting, prioritizing, fixing, validating, and reporting on these issues (and assets) adds up to real money, which demonstrates the value of an automated solution (like ours) by orders of magnitude.

Do Something, Differently

After all of the math and assumptions we have covered here, no statistics, numbers, or even this graphical comparison will likely change anyone’s pre-held beliefs about external attack surface management. Even though the data strongly indicates that the TCO with CyCognito will be 75% or less than current efforts with a much greater frequency (continuously) and better coverage of your internet-exposed attack surface (coverage much, much closer to 100% than you’re achieving now).

Trying to accomplish manually what CyCognito does would cost you 5-6x more per year than you’re already paying, and would still yield unpredictable results: coordinating teams, tools, and processes becomes an expensive burden and most integrations cannot be easily automated.

Figure 3 - Screen capture from CyCognito’s External Attack Surface Management TCO calculator.

If you are intrigued and would like to take the next steps in doing attack surface management differently, please schedule some time and we can walk you through our TCO calculator to uncover the hidden costs of your current attack surface management processes today.