Discover, remediate, and protect attack surface exposures.
Gartner® Threat Exposure RoadmapExposure management (EM) is the process of addressing the access points – or attack vectors – and digital/physical assets along an organization’s attack surface that could increase overall risk posture by being vulnerable to threat actors and breaches.
Getting into specifics of exactly how a security organization might go about managing exposure to threats, there are many avenues CISOs and other practitioners might take. One of the more exhaustive solutions, however, is cyber asset attack surface management (CAASM). This is a tool that organizations can leverage to exhaustively inventory digital assets in order to gain greater visibility of their security posture at any given time.
However, Gartner® states, “Without widespread business engagement most exposure management functions, such as vulnerability assessment, are unable to function effectively. Early engagement with resolver teams and the development of mobilization processes are essential to success.”
Security practitioners must garner buy-in from the stakeholders who not only control the budget, but also dictate the current key performance indicators (KPIs) governing the direction – and therefore state of digital risk – of the company.
To this end, the Gartner research also recommends that security and risk management leaders should “build exposure assessment scopes based on key business priorities and risks, taking into consideration the potential business impact of a compromise rather than primarily focusing on the severity of the threat alone.”
EM is essentially an umbrella term that encompasses different methods of protecting and remediating potential vulnerabilities along an enterprise network’s attack surface – both on and off of the cloud. To avoid confusion, let’s dive into some of the specific ways organizations can succeed in managing exposure and threats.
Exposure management and vulnerability management (VM) essentially cover off on similar functions – plugging gaps in a network and its systems/applications – but VM could be considered a sub-function of exposure management.
Put in simple terms, EM protects the network perimeter, behind which lie the systems and applications running on the network. However, Gartner believes that “EM will supersede the vulnerability management practices of today.” Essentially, the category of EM would subsume VM, with the overall category focusing on solutions that can secure network attack surfaces from intrusion and fortify their systems against weaknesses.
Where security organizations are more often looking to move in the modern era is plotting out the totality of potential exposures along the network attack surface, whether that’s a misconfiguration in an identity and access management (IAM) protocol or vulnerability that is seeing active exploitation and must immediately be prioritized for remediation.
This broader view that brings together similar remediation actions may well see the advent of more consolidated tools that can address the more subtle differences in the range of issues that could be exploitable. These tools should have the capabilities to effectively enable multiple outcomes and drive efficiency.
EM is important because it is necessary to leverage tools that can help to identify and remediate any exposures that could potentially be exploited by threat actors. EM is also important because it is – as previously mentioned – a topic and platform that can encompass many different functions.
Attack surface management (ASM) is the process of maintaining visibility into an ever-changing network environment so that security teams can patch vulnerabilities and defend against emerging threats along the network.
External attack surface management (EASM) is the process of identifying internal business assets that are public-internet facing and monitoring for vulnerabilities, public-cloud misconfigurations, exposed credentials, or other external information and processes that could be exploited by attackers.
Cyber asset attack surface management (CAASM) provides a unified view of all cyber assets so security personnel can identify exposed assets and potential security gaps through data integration, conversion, and analytics. It is intended to be an authoritative source of asset information complete with ownership, network, and business context.
Digital risk protection (DRP) is the process of safeguarding digital assets and brand reputation from external threats. DRP solutions operate on the premise that organizations can use threat actor activity to their advantage to identify attacks before they happen. DRP leverages insights derived from cyber threat intelligence (CTI) monitoring to surface actionable areas of protection.
Pinpointing and correcting gaps, vulnerabilities, authentication configuration errors, and many other security issues are actions that security teams typically need to fix fast. EM platforms are important because they encompass many capabilities that enable security teams to do just that.
It's important to know the functions of an overall EM lifecycle as the implications of those processes will determine which type of program a specific organization with specific needs ultimately implements to best support that business. Let's take a look at the basic EM lifecycle:
Automating these processes will enable security practitioners to quickly validate exposures and their level of risk, creating systems for faster prioritization and remediation. An EM program lifecycle will not be a plug-and-play implementation.
It will require processes that are agreed upon by stakeholders all over the organization with different priorities. But the work that goes into building this bespoke program will be well worth the money and stress saved down the line.
As we've learned, EM encompasses more than just exposures to the internet and potential threat actors. But what positive effects and benefits can an effective EM program have on the business and its bottom line?
Stakeholders must be able to properly scope risk in order to determine potential threat exposures. If it is determined that certain factors simply aren't considered risks at a given moment in time, then it follows that something that could be seen at as an exposure might not be categorized that way.
If exposures are properly scoped according to risk value, then higher-value internal stakeholders – CISO, IT directors, executive team – will more clearly see and experience the bottom-line benefit security can bring to the company by correctly categorizing exposures and addressing them in order of real priority.
With increased abilities to prioritize and move faster, implementing an effective EM platform can quickly impart an improved security posture to the organization. A stronger security posture also means internal and external policies and regulations are likely being followed more frequently, which also puts the business in a stronger position of compliance.
In terms of network access control (NAC), EM's likely key strength is pinpointing and helping to remediate exposures that shouldn’t exist. Once those are plugged, this improves the ability of the security operations center (SOC) to automate control over who gains access to the network – and kick them off if they don’t have a right to be there.