Principles of attack surface protection: Time crowns the winner in security.

An image of , Security & Data, Principles of attack surface protection: Time crowns the winner in security.

The principle of time permeates each aspect of attack surface protection that this series has covered. Contrasted to the other four principles — Discover, Assess, Prioritize and Remediate — time is like the unrelenting ticking of the race clock. Every time a new security gap is created, it is an all-out race between attackers and defenders, with the winner taking all.

Respond too slowly, and you’ll allow attackers into your systems — no one will care that your detection or prioritization capabilities were top-notch.

Act before attackers, and victory is yours. So how do you get and stay ahead for every single new security gap? Move quickly through those vital stages of securing the extended attack surface, shorten the response time and automate where you can.

Time-related risks for the stages of attack surface protection

Consider some of the principal risks of time pertaining to each aspect of attack surface protection.

· Discover: For most organizations, their external attack surface — assets exposed to the internet — is a mammoth, amorphous entity where many risks are shrouded in fog because they are in assets unknown to or not managed by, the security team. Time is of the essence when attackers are constantly pounding on your server, especially when it belongs to a subsidiary that you didn’t know was yours. Without good visibility, it can take weeks, potentially even years, to learn about unknown or unmanaged networks, cloud environments and even acquired subsidiaries.

· Assess: Organizations typically assess the security of assets only periodically: once a month, a quarter or even a year. This gives attackers plenty of time to find the most attractive weak spots and attack them. Testing assets more frequently reduces the risk of a breach by exposing your security gaps sooner so security teams can address them.

· Prioritize: Risk prioritization requires classification of assets by business purpose. This core component of the prioritization process is normally done via an error-prone manual process. Prioritization delays can be deadly from a risk perspective, especially with security teams swamped by thousands of “urgent” alerts lacking context on how much risk they really carry.

· Remediate: Mitigating the security gap, the last step for protection, demands maximum time efficiency from remediation teams. Prioritization is key for this step. Without a well-ordered list of fixes, ideally informed by business context and exploitability, remediation teams lose time fixing the wrong things.

Speed up the cadence to improve protection

The timing of each stage of protection has implications for enterprise security. Testing, which is the primary tool of assessment, often follows a cadence similar to an organization’s compliance regime. Standards such as the PCI.

Data Security Standard might require scans or tests quarterly, while other regimes might require only a semi-annual or annual test.

Giving attackers three whole months to find new security gaps and exploit them is a lifetime. This renders compliance regimes essentially meaningless as security guideposts. It may get you off the starting blocks, but chances are that

the start of the race is the last time you’re even in the race, and attackers will find a way in well before you can fix it. There are thousands of offensive groups scanning various assets all of the time, so it’s really a situation where your one team is in a race against thousands of attacker groups. That is why it is so important to do everything you can to even the odds. Speeding the cadence of testing is one of these things.

Improving the key indicator of time: MTTR

Attackers continuously scan IP ranges at large companies, immediately exploiting what they find. So, mean time to respond, repair or remediate is a key indicator of a security team’s ability to control and reduce risks in a timely fashion.

For instance, at one of our customers, we identified a 15-year-old on-prem server connected to its network. No one knew the server’s purpose, so no one ever unplugged it. It functioned as an informal coffee table. Our platform discovered it was internet-exposed, easily seen and could be compromised and used in a lateral attack. Just finding vulnerable devices like this one can take months or years (if it’s ever discovered) — an MTTR that is unacceptably slow in today’s high-risk environment.

Conclusion

Time is critical for attack surface protection. Solid processes, automated at scale, help eliminate material risk faster for immeasurably stronger security. Focus on these three things as you work to reduce your process times.

1. When attackers find something before you do it will be exploited. At any given moment, you need to be able to identify — and report to management — on your top 10 security gaps. These typically create 90% of the business risk.

2. If your MTTR is measured in months, slow attack surface mapping and risk prioritization are usually the primary culprits. Focus on decreasing the time it takes to find networks, applications and cloud environments, especially those you weren’t previously aware of or don’t manage. And find ways to contextualize assets and risks.

3. Your security teams are already stretched to their limits. Empower them with automated solutions that accelerate the attack surface protection process so they can leverage their expertise where it matters most.

Addressing Regulatory Compliance in Government-Owned, Single-Use Devices

Nadav Avni • 26th March 2024

Corporate-owned single-use (COSU) devices, also known as dedicated devices, make work easier for businesses and many government agencies. They’re powerful smart devices that fulfil a single purpose. Think smart tablets used for inventory tracking, information kiosks, ATMs, or digital displays. But, in a government setting, these devices fall under strict regulatory compliance standards.

Advantages of Cloud-based CAD Solutions for Modern Designers

Marius Marcus • 22nd March 2024

Say goodbye to the days of clunky desktop software chaining us to specific desks. Instead, we’re stepping into a new era fueled by cloud CAD solutions. These game-changing tools not only offer designers unmatched flexibility but also foster collaboration and efficiency like never before!

What are Multi-core Safety-Critical Avionics?

Wind River • 13th March 2024

A multi-core processor is a type of central processing unit that integrates multiple individual processing units onto a single chip. It supports different cores executing their tasks simultaneously, for quick and enhanced overall performance. Multi-core processors nowadays support safety-critical avionics. Find out more about what multi-core processors are, what multi-core safety-critical avionics are, and how...

Why Transition from 4G to 5G+ vRAN/O-RAN?

Emily Goldshteyn • 13th March 2024

The journey from legacy to 5G doesn’t have to be off-putting. It is a process that, if approached strategically, can make your company a pioneer in the digital age. Virtual and Open RAN, which come with broader choices of technology options and greater flexibility, are giving service providers greater opportunity as they transition their networks....