Free Book - External Exposure & Attack Surface Management for Dummies
The principle of time permeates each aspect of attack surface protection that this series has covered. Contrasted to the other four principles — Discover, Assess, Prioritize and Remediate — time is like the unrelenting ticking of the race clock. Every time a new security gap is created, it is an all-out race between attackers and defenders, with the winner taking all.
Respond too slowly, and you’ll allow attackers into your systems — no one will care that your detection or prioritization capabilities were top-notch. Act before attackers, and victory is yours. So how do you get and stay ahead for every single new security gap? Move quickly through those vital stages of securing the extended attack surface, shorten the response time and automate where you can.
Time-Related Risks For The Stages Of Attack Surface Protection
Consider some of the principal risks of time pertaining to each aspect of attack surface protection.Speed Up The Cadence To Improve Protection
The timing of each stage of protection has implications for enterprise security. Testing, which is the primary tool of assessment, often follows a cadence similar to an organization’s compliance regime. Standards such as the PCI Data Security Standard might require scans or tests quarterly, while other regimes might require only a semi-annual or annual test.
Giving attackers three whole months to find new security gaps and exploit them is a lifetime. This renders compliance regimes essentially meaningless as security guideposts. It may get you off the starting blocks, but chances are that the start of the race is the last time you’re even in the race, and attackers will find a way in well before you can fix it.
There are thousands of offensive groups scanning various assets all of the time, so it’s really a situation where your one team is in a race against thousands of attacker groups. That is why it is so important to do everything you can to even the odds. Speeding the cadence of testing is one of these things.
Improving The Key Indicator Of Time: MTTR
Attackers continuously scan IP ranges at large companies, immediately exploiting what they find. So, mean time to respond, repair or remediate is a key indicator of a security team’s ability to control and reduce risks in a timely fashion.
For instance, at one of our customers, we identified a 15-year-old on-prem server connected to its network. No one knew the server’s purpose, so no one ever unplugged it. It functioned as an informal coffee table. Our platform discovered it was internet-exposed, easily seen and could be compromised and used in a lateral attack. Just finding vulnerable devices like this one can take months or years (if it’s ever discovered) — an MTTR that is unacceptably slow in today’s high-risk environment.
Conclusion
Time is critical for attack surface protection. Solid processes, automated at scale, help eliminate material risk faster for immeasurably stronger security. Focus on these three things as you work to reduce your process times.
1. When attackers find something before you do it will be exploited. At any given moment, you need to be able to identify — and report to management — on your top 10 security gaps. These typically create 90% of the business risk.
2. If your MTTR is measured in months, slow attack surface mapping and risk prioritization are usually the primary culprits. Focus on decreasing the time it takes to find networks, applications and cloud environments, especially those you weren’t previously aware of or don’t manage. And find ways to contextualize assets and risks.
3. Your security teams are already stretched to their limits. Empower them with automated solutions that accelerate the attack surface protection process so they can leverage their expertise where it matters most.