Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat Asia
May 4-7, 2021
Virtual Event
Black Hat USA
July 31 - August 5, 2021
Las Vegas, NV, USA
Black Hat Europe
November 8-11, 2021
Virtual Event
2/28/2019
12:00 PM
Ram Venugopalan
Ram Venugopalan
Event Updates
50%
50%

Shifting Left in the Cybersecurity Defense Lifecycle

Identifying your risk posture should be the first objective of all cybersecurity programs. Yet, this is where organizations often fail, due to weak visibility and understanding during the crucial "identify" phase of the cybersecurity lifecycle. Focusing on protect, detect, respond, recover without an understanding of risk posture leads to failed security strategies.

 

Identifying your risk posture should be the first objective of all cybersecurity programs. Yet, this is where organizations often fail, due to weak visibility and understanding during the crucial “identify” phase of the cybersecurity lifecycle. Focusing on protect, detect, respond, recover without an understanding of risk posture leads to failed security strategies.

The cybersecurity defense lifecycle has a NIST Framework created for the purpose of helping organizations reduce and better manage cyber risks. It depicts the phases of a continuous lifecycle on a continuum like so: identify->protect->detect->respond->recover (Figure 1).

The NIST Cybersecurity Framework depicts the phases of a continuous lifecycle on a continuum like so: identify-protect-detect-respond-recover.

Figure 1: NIST Cybersecurity Framework.

The cyber defense industry has had a huge focus in recent years on innovations relevant to the protect, detect and respond/recover aspects of this lifecycle. The cybersecurity landscape has been exploding with several hundreds of vendors (~500) in an ever-increasing number of areas and specializations. How do you know whether you need every one of these tools in your toolbox or just a couple?

It all starts with the “identify” stage, which begins with an initial understanding of your own risk posture that then develops into a more comprehensive risk management strategy with a focus on reducing your cyber exposure. This beginning allows for a measured response, rather than a spray-and-pray approach that is unlikely to yield the results you're looking for. Understanding your own risk posture requires getting a continuously updated picture of your assets and information about the importance of those assets, and with a picture of the attack surface exposed by those assets directly or indirectly. Combining this level of insight with the risk introduced by humans -- whether inside or outside your organization -- gives you a much better picture of risk.

In the past, identification of assets was a relatively uncomplicated problem to solve. Your assets were physical assets that you knew, you could touch and, for the most part, they never left the building. As you move from that world into the world of BYOD, IoT, virtual machines, public cloud, containers and now serverless computing, those assets can be increasingly ephemeral and hard to discover and control. Furthermore, there’s been a significant increase in the sheer number of vulnerabilities over the past several years, with last year exhibiting a significant spike and this year on target to come close to or even exceed last year (Figure 2). The ever-changing elastic attack surface created by the evolution of assets from physical to increasingly ephemeral has created a massive gap in an organization’s ability to truly understand its Cyber Exposure at any given time. We call this the Cyber Exposure gap.

Vulnerability distribution trends over time (Source: NVD)

Figure 2: Vulnerability distribution trends over time (Source: NVD).

Recent high-profile breaches like Equifax, which was identified as being due to not patching an Apache Struts vulnerability for months, has led to significant focus on accelerating the time it takes to fix vulnerabilities across the corporate landscape.

This isn’t and hasn’t been an easy problem to solve for most organizations. The complexity of dealing with the vulnerabilities found in an organization has been increasing multiplicatively as a result of the sheer number of vulnerabilities across an ever-changing and expanding asset landscape. This is further complicated by having to consider the effect of a large variety of security products that could mitigate a vulnerability under specific circumstances and configurations. Last, but not least, is the fact that the process of fixing these vulnerabilities now also spans a variety of human owners and operators due to the varied nature of assets today.

In addition to the effort required to understand the current cyber exposure of an organization, future technology adoption decisions are also facing security considerations such as:

  • Will adopting technology X increase risk and how do we mitigate it?
  • How do I keep a view of my ever-changing cyber risk posture so that I always know where to pay attention?
  • How do I become more proactive in closing the cyber exposure gap?

So, where should we start?

The weakest spots in an organization’s security posture occur at the intersection of attack surface, avenues of attack (attack vectors) and obstacles/ (lack of) controls in place. Identifying these weak spots should be the first objective of all cybersecurity programs. This is also where several fail, due to weak visibility and understanding during that crucial “identify” phase.

The weakest spots in an organization’s security posture occur at the intersection of attack surface, avenues of attack (attack vectors) and obstacles/ (lack of) controls in place.

As a practice, we would all be better off with shifting further left in the lifecycle to address the right problems with the right solutions. That said, it isn’t enough to merely shift left at the start of your program for better cyber hygiene, it has to be an active part of your program, where it is revisited and continuously assessed.

Where are the top vulnerabilities found in the enterprise? Read the Vulnerability Intelligence Report from Tenable Research to find out.

Identifying your risk posture should be the first objective of all cybersecurity programs. Yet, this is where organizations often fail, due to weak visibility and understanding during the crucial “identify” phase of the cybersecurity lifecycle. Focusing on protect, detect, respond, recover without an understanding of risk posture leads to failed security strategies.

The cybersecurity defense lifecycle has a NIST Framework created for the purpose of helping organizations reduce and better manage cyber risks. It depicts the phases of a continuous lifecycle on a continuum like so: identify->protect->detect->respond->recover (Figure 1).

The NIST Cybersecurity Framework depicts the phases of a continuous lifecycle on a continuum like so: identify-protect-detect-respond-recover.

Figure 1: NIST Cybersecurity Framework.

The cyber defense industry has had a huge focus in recent years on innovations relevant to the protect, detect and respond/recover aspects of this lifecycle. The cybersecurity landscape has been exploding with several hundreds of vendors (~500) in an ever-increasing number of areas and specializations. How do you know whether you need every one of these tools in your toolbox or just a couple?

It all starts with the “identify” stage, which begins with an initial understanding of your own risk posture that then develops into a more comprehensive risk management strategy with a focus on reducing your cyber exposure. This beginning allows for a measured response, rather than a spray-and-pray approach that is unlikely to yield the results you're looking for. Understanding your own risk posture requires getting a continuously updated picture of your assets and information about the importance of those assets, and with a picture of the attack surface exposed by those assets directly or indirectly. Combining this level of insight with the risk introduced by humans -- whether inside or outside your organization -- gives you a much better picture of risk.

In the past, identification of assets was a relatively uncomplicated problem to solve. Your assets were physical assets that you knew, you could touch and, for the most part, they never left the building. As you move from that world into the world of BYOD, IoT, virtual machines, public cloud, containers and now serverless computing, those assets can be increasingly ephemeral and hard to discover and control. Furthermore, there’s been a significant increase in the sheer number of vulnerabilities over the past several years, with last year exhibiting a significant spike and this year on target to come close to or even exceed last year (Figure 2). The ever-changing elastic attack surface created by the evolution of assets from physical to increasingly ephemeral has created a massive gap in an organization’s ability to truly understand its Cyber Exposure at any given time. We call this the Cyber Exposure gap.

Vulnerability distribution trends over time (Source: NVD)

Figure 2: Vulnerability distribution trends over time (Source: NVD).

Recent high-profile breaches like Equifax, which was identified as being due to not patching an Apache Struts vulnerability for months, has led to significant focus on accelerating the time it takes to fix vulnerabilities across the corporate landscape.

This isn’t and hasn’t been an easy problem to solve for most organizations. The complexity of dealing with the vulnerabilities found in an organization has been increasing multiplicatively as a result of the sheer number of vulnerabilities across an ever-changing and expanding asset landscape. This is further complicated by having to consider the effect of a large variety of security products that could mitigate a vulnerability under specific circumstances and configurations. Last, but not least, is the fact that the process of fixing these vulnerabilities now also spans a variety of human owners and operators due to the varied nature of assets today.

In addition to the effort required to understand the current cyber exposure of an organization, future technology adoption decisions are also facing security considerations such as:

  • Will adopting technology X increase risk and how do we mitigate it?
  • How do I keep a view of my ever-changing cyber risk posture so that I always know where to pay attention?
  • How do I become more proactive in closing the cyber exposure gap?

So, where should we start?

The weakest spots in an organization’s security posture occur at the intersection of attack surface, avenues of attack (attack vectors) and obstacles/ (lack of) controls in place. Identifying these weak spots should be the first objective of all cybersecurity programs. This is also where several fail, due to weak visibility and understanding during that crucial “identify” phase.

The weakest spots in an organization’s security posture occur at the intersection of attack surface, avenues of attack (attack vectors) and obstacles/ (lack of) controls in place.

As a practice, we would all be better off with shifting further left in the lifecycle to address the right problems with the right solutions. That said, it isn’t enough to merely shift left at the start of your program for better cyber hygiene, it has to be an active part of your program, where it is revisited and continuously assessed.

Where are the top vulnerabilities found in the enterprise? Read the Vulnerability Intelligence Report from Tenable Research to find out.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27734
PUBLISHED: 2021-05-17
Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users.
CVE-2021-27342
PUBLISHED: 2021-05-17
An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumvent the anti-brute-force cool-down delay period via a timing-based side-channel attack
CVE-2021-31727
PUBLISHED: 2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL 0x8000201...
CVE-2021-31728
PUBLISHED: 2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook wit...
CVE-2021-32402
PUBLISHED: 2021-05-17
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.