By Alexander Jones, International Banker
As businesses continue to undergo digital transformations at a breathless pace, the sheer number of attack surfaces—that is, the sum of the points within organisations’ software environments that unauthorised and potentially malicious users can exploit—is skyrocketing, which, in turn, is raising the likelihood of cyberattacks, data breaches and other security risks occurring. As such, cybersecurity stands among the highest priorities for enterprises globally in 2024 as security teams battle to resolve the breadth and depth of these risks on a sustained basis. Can they win this battle? Absolutely. However, a formal risk-mitigation approach is required so that businesses can build resilience over time and consistently remediate threats and vulnerabilities most effectively. And that’s why continuous threat exposure management (CTEM) is vital.
Indeed, the digital evolution of the typical organisation, the growing demands of employees for remote work and the deployment of cloud technologies have vastly broadened that business’s attack surface, thus positioning significantly more of the company’s valuable assets as potentially exposed. However, businesses’ responses are invariably lacking, and thus, they require significant enhancements of their security postures to deal with these expanding and increasingly sophisticated threats effectively. And with attackers today managing to accomplish their nefarious objectives with ever-increasing speed and ruthlessness, businesses’ security teams are often left spending much of their time retrospectively analysing the inflicted damage rather than working to build long-term resilience and prevent future attacks more capably.
CTEM is increasingly regarded as improving enterprises’ security postures enough to solve this problem. Championed by Gartner, its goal is “to get a consistent, actionable security posture remediation and improvement plan that business executives can understand and architecture teams can act upon,” the business tech-research firm asserted in June 2022. Instead of representing a specific technology available through “vendors”, CTEM functions as a proactive, continuously evolving approach towards threat-exposure remediation that enables businesses to prioritise the most dangerous threats and corresponding solutions effectively.
It is this proactive, forward-looking approach that sets CTEM apart from other approaches to vulnerability management. Amidst an increasingly hostile cyber-threat environment, the need for continuous monitoring and rapid responses to potentially severe threats from bad actors has become critical, especially given the speed and sophistication with which they operate. By continuously monitoring an organisation’s digital infrastructure, CTEM recognises the threats associated with an expanded attack surface, thus offering up a wide-ranging strategy to manage the most crucial vulnerabilities. This approach flips the organisation’s security posture from reactive to proactive, enabling much greater threat prevention in the long run.
CTEM thus enables businesses to adapt to threats flexibly, responding quickly to minimise attackers’ exploitative opportunities and highlighting to security teams the most critical vulnerabilities on which to focus. By prioritising some threats over others based on the magnitude of the damage they can potentially inflict, moreover, organisations can more efficiently allocate their resources to address risks of varying severity and respond quickly to the most dangerous threats.
With the CTEM process being continuously deployed, businesses are pressed to assess, respond and upgrade their security credentials in real-time. Actionable responses are typically generated by monitoring real-time data related to potential cyber threats, allowing organisations to implement appropriate remediation measures quickly and efficiently. Ultimately, this data-driven approach leads to a consistent build-up of cyber-defences as enterprises patch the latest vulnerable security issues over time and continue learning, evolving and improving their cybersecurity capabilities.
Such a programme also requires considerable coordination across various relevant divisions within a well-run organisation, including management, operations, IT (information technology) and business-development teams. This means that multiple stakeholders throughout the organisation are working in concert to reduce security risks holistically as a common end goal. Such an approach thus positions cybersecurity in the fabric of the business culture, ensuring virtually all teams have a vested interest in protecting their organisation.
Indeed, an effective CTEM programme will enable cybersecurity strategies to be well aligned with the organisation’s broader business objectives, according to Picus Security. “By understanding and incorporating the business’s strategic goals into the CTEM program, organizations can ensure that their security efforts support, rather than hinder, their organizational goals,” the San Francisco-based cybersecurity firm explained in November. “This alignment increases the value of cybersecurity efforts and ensures that they contribute to the overall success of the organization.” Picus also highlighted the cost benefits that CTEM can deliver by proactively identifying and mitigating expenses incurred due to security breaches and issues such as recovery outlays, regulatory costs and reputational damages.
So, how does an organisation go about designing a successful CTEM programme? According to Gartner, there are five key steps that businesses ought to implement:
This might involve assessing an external attack surface or a SaaS (software as a service) security posture as remote work becomes a more permanent trend. A CTEM programme “allows enterprises to continually and consistently evaluate the accessibility, exposure and exploitability of an enterprise’s digital and physical assets,” Gartner noted.
There are several methods to reach those objectives, including attack surface management (ASM), continuous automated red teaming (CART), attack path mapping (APM) and breach and attack simulation (BAS).
It is also worth coordinating with all relevant business stakeholders to determine what exact triggers should prompt remediation.
Enterprises can also invest in one of the increasing number of CTEM platforms being brought to the market. IBM Security Randori, for instance, combines external attack surface management with continuous automated red teaming to deliver a comprehensive CTEM programme to assist organisations. “By implementing a CTEM program with IBM Security Randori, you can help your security teams proactively assess and manage your organization’s exposure to various cyber threats and vulnerabilities on an ongoing basis,” IBM notes on its website. “It helps you understand your unique threat landscape and implement remediation measures to mitigate and minimize the risks that are most relevant to your security posture instead of trying to find and patch every vulnerability, even if it has a minimal impact on your business.”
Gartner predicted that by 2026, organisations that prioritise their security investments based on a continuous threat exposure management programme would realise a two-thirds reduction in the likelihood of suffering a breach. “As technology and cyber threats evolve, a CTEM program can adapt to these changes, ensuring continuous and relevant protection,” Picus Security observed. “This adaptability is crucial in today’s fast-paced digital landscape, where new threats can emerge rapidly.”
Back To Top
The post Why Continuous Threat Exposure Management Is Vital for Businesses’ Cyber-Defences appeared first on International Banker.
As businesses continue to undergo digital transformations at a breathless pace, the sheer number of attack surfaces—that is, the sum of the points within organisations’ software environments that unauthorised and potentially malicious users can exploit—is skyrocketing, which, in turn, is raising the likelihood of cyberattacks, data breaches and other security risks occurring. As such, cybersecurity stands among the highest priorities for enterprises globally in 2024 as security teams battle to resolve the breadth and depth of these risks on a sustained basis. Can they win this battle? Absolutely. However, a formal risk-mitigation approach is required so that businesses can build resilience over time and consistently remediate threats and vulnerabilities most effectively. And that’s why continuous threat exposure management (CTEM) is vital.
Indeed, the digital evolution of the typical organisation, the growing demands of employees for remote work and the deployment of cloud technologies have vastly broadened that business’s attack surface, thus positioning significantly more of the company’s valuable assets as potentially exposed. However, businesses’ responses are invariably lacking, and thus, they require significant enhancements of their security postures to deal with these expanding and increasingly sophisticated threats effectively. And with attackers today managing to accomplish their nefarious objectives with ever-increasing speed and ruthlessness, businesses’ security teams are often left spending much of their time retrospectively analysing the inflicted damage rather than working to build long-term resilience and prevent future attacks more capably.
CTEM is increasingly regarded as improving enterprises’ security postures enough to solve this problem. Championed by Gartner, its goal is “to get a consistent, actionable security posture remediation and improvement plan that business executives can understand and architecture teams can act upon,” the business tech-research firm asserted in June 2022. Instead of representing a specific technology available through “vendors”, CTEM functions as a proactive, continuously evolving approach towards threat-exposure remediation that enables businesses to prioritise the most dangerous threats and corresponding solutions effectively.
It is this proactive, forward-looking approach that sets CTEM apart from other approaches to vulnerability management. Amidst an increasingly hostile cyber-threat environment, the need for continuous monitoring and rapid responses to potentially severe threats from bad actors has become critical, especially given the speed and sophistication with which they operate. By continuously monitoring an organisation’s digital infrastructure, CTEM recognises the threats associated with an expanded attack surface, thus offering up a wide-ranging strategy to manage the most crucial vulnerabilities. This approach flips the organisation’s security posture from reactive to proactive, enabling much greater threat prevention in the long run.
CTEM thus enables businesses to adapt to threats flexibly, responding quickly to minimise attackers’ exploitative opportunities and highlighting to security teams the most critical vulnerabilities on which to focus. By prioritising some threats over others based on the magnitude of the damage they can potentially inflict, moreover, organisations can more efficiently allocate their resources to address risks of varying severity and respond quickly to the most dangerous threats.
With the CTEM process being continuously deployed, businesses are pressed to assess, respond and upgrade their security credentials in real-time. Actionable responses are typically generated by monitoring real-time data related to potential cyber threats, allowing organisations to implement appropriate remediation measures quickly and efficiently. Ultimately, this data-driven approach leads to a consistent build-up of cyber-defences as enterprises patch the latest vulnerable security issues over time and continue learning, evolving and improving their cybersecurity capabilities.
Such a programme also requires considerable coordination across various relevant divisions within a well-run organisation, including management, operations, IT (information technology) and business-development teams. This means that multiple stakeholders throughout the organisation are working in concert to reduce security risks holistically as a common end goal. Such an approach thus positions cybersecurity in the fabric of the business culture, ensuring virtually all teams have a vested interest in protecting their organisation.
Indeed, an effective CTEM programme will enable cybersecurity strategies to be well aligned with the organisation’s broader business objectives, according to Picus Security. “By understanding and incorporating the business’s strategic goals into the CTEM program, organizations can ensure that their security efforts support, rather than hinder, their organizational goals,” the San Francisco-based cybersecurity firm explained in November. “This alignment increases the value of cybersecurity efforts and ensures that they contribute to the overall success of the organization.” Picus also highlighted the cost benefits that CTEM can deliver by proactively identifying and mitigating expenses incurred due to security breaches and issues such as recovery outlays, regulatory costs and reputational damages.
So, how does an organisation go about designing a successful CTEM programme? According to Gartner, there are five key steps that businesses ought to implement:
- Scope the entire business’s “attack surface” for cybersecurity exposures: Scan all entry points and assets for potential vulnerabilities, including not only traditional devices, mobile apps and other applications but also the “less tangible” elements that might include corporate social-media accounts, online code repositories and integrated supply-chain systems.
This might involve assessing an external attack surface or a SaaS (software as a service) security posture as remote work becomes a more permanent trend. A CTEM programme “allows enterprises to continually and consistently evaluate the accessibility, exposure and exploitability of an enterprise’s digital and physical assets,” Gartner noted.
- Develop a discovery process for assets and their risk profiles: Go beyond merely the attack surface level and identify visible and hidden assets, vulnerabilities, misconfigurations and other risks. “Confusion between scoping and discovery is often the first failure when building a CTEM program,” according to Gartner. “The volume of discovered assets and vulnerabilities is not success in and of itself; it’s far more valuable to accurately scope based on business risk and potential impact.”
- Prioritise the threats most likely to be exploited: Identify the business’s high-value assets and formulate a treatment plan to address them. The prioritisation process should account for the following:
- Urgency,
- Security,
- Availability of compensating controls,
- Tolerance for residual attack surface,
- Level of risk posed to the organisation.
- Validation: Assess the likelihood of a successful attack, how the attack might work and how systems would react. Verify whether specific vulnerabilities could be exploited before accounting for all potential attack routes to the asset. Finally, check that the current response plan is sufficiently fast and capable of protecting the business.
There are several methods to reach those objectives, including attack surface management (ASM), continuous automated red teaming (CART), attack path mapping (APM) and breach and attack simulation (BAS).
It is also worth coordinating with all relevant business stakeholders to determine what exact triggers should prompt remediation.
- Mobilisation of people and processes: Automated remediation will only take you so far. The CTEM programme must also be clearly communicated to—and understood by—the security team and various relevant business stakeholders. “The objective of the ‘mobilization’ effort is to ensure teams operationalize the CTEM findings by reducing any obstacles to approvals, implementation processes or mitigation deployments. In particular, document cross-team approval workflows,” according to Gartner.
Enterprises can also invest in one of the increasing number of CTEM platforms being brought to the market. IBM Security Randori, for instance, combines external attack surface management with continuous automated red teaming to deliver a comprehensive CTEM programme to assist organisations. “By implementing a CTEM program with IBM Security Randori, you can help your security teams proactively assess and manage your organization’s exposure to various cyber threats and vulnerabilities on an ongoing basis,” IBM notes on its website. “It helps you understand your unique threat landscape and implement remediation measures to mitigate and minimize the risks that are most relevant to your security posture instead of trying to find and patch every vulnerability, even if it has a minimal impact on your business.”
Gartner predicted that by 2026, organisations that prioritise their security investments based on a continuous threat exposure management programme would realise a two-thirds reduction in the likelihood of suffering a breach. “As technology and cyber threats evolve, a CTEM program can adapt to these changes, ensuring continuous and relevant protection,” Picus Security observed. “This adaptability is crucial in today’s fast-paced digital landscape, where new threats can emerge rapidly.”
Back To Top
The post Why Continuous Threat Exposure Management Is Vital for Businesses’ Cyber-Defences appeared first on International Banker.