Cyber Exposure – The Next Frontier Elizabeth Leon and Timothy Yungwirth

TOPICS Today’s IT is creating a cyber exposure gap Who’s affected? How to reduce your cyber exposure gap

Today’s IT is Creating a Cyber Exposure Gap

Digital Transformation is Accelerating Every organization is transforming into an information organization Putting pressure on every function to innovate and operate faster “Bold, tightly integrated digital strategies will be the biggest differentiator between companies that win and companies that don’t.” – McKinsey & Co.

How Are You Responding? What is the organization’s digital strategy? How is Security enabling that strategy?  

The Attack Surface is Expanding IoT Industrial IoT ICS/SCADA Enterprise IoT Cloud Cloud Container Web app Virtual machine Mobile Laptop IT Server Desktop Network infrastructure

Creating a Cyber Exposure Gap IoT Industrial IoT ICS/SCADA Enterprise IoT Cloud Cloud Container Web app Virtual machine Mobile Laptop IT Server Desktop Network infrastructure

Cyber Exposure is an emerging discipline for: Managing and measuring your modern attack surface to accurately understand and reduce your cyber risk

Why? Discovering Short-Lived Assets is Hard Traditional: Servers Modern: Containers Request Deploy Patch Retire

Why? Assessing State of Cloud Environments is Hard Visibility 8% ...companies that know the scope of shadow IT at their organizations, according to a survey by the Cloud Security Alliance Compliance 48% ...of organizations store some sensitive data, like employee records, in the cloud according to a SANS Security in the Cloud report Consistency 31% … of respondents in the same SANS report found poor configuration practices in place due to applications being spun up quickly

Why? Maintaining Application Security is Hard Number of web applications with at least ONE vulnerability1: 99.7% Average number of web application vulnerabilities2: 3 Average time to fix web application vulnerabilities2: Critical Risk: 129 days High Risk: 196 days Sources: TechRepublic, “Report: 99.7% of web apps have at least one vulnerability,” June 20, 2017 White Hat Security, “2017 Application Security Statistics Report,” July 2017

Who’s Affected?

New Stakeholders and Asset Owners Will Impact an Organization’s Cyber Exposure OT / IoT Cloud Container OT Manager, Engineer Line of Business DevOps OT assets are becoming an expansive attack surface Shadow IT and cloud assets are creating a huge blind spot DevOps velocity requires new security approaches

Security Teams Need to Provide Strategic Insight and Manage Risk Across The Organization Reduce risk across a growing modern attack surface Security Director OT Manager, Engineer DevOps Increase SOC efficiency Maintain regulatory compliance Line of Business Secure DevOps processes Decrease costs to fix defects Protect brand equity Gain strategic decision support on risk

How to Reduce Your Cyber Exposure Gap

Addressing the Full Cyber Exposure Lifecycle Discover Identify and map every asset for visibility across any computing environment Measure Assess Model and analyze cyber exposure to make better business and technology decisions Understand the state of all assets, including vulnerabilities, misconfigurations and other health indicators IoT OT Cloud IT Fix Analyze Prioritize which exposures to fix first, if at all, and apply the appropriate remediation technique Understand exposures in context, to prioritize remediation based on asset criticality, threat context and vulnerability severity

Discover Every Asset server desktop laptop mobile virtual public cloud web app container

Active Scanning + Additional Data Sensors Agent Scanning Endpoint Networks Active Scanning Intelligent Connectors Web Mobile Cloud Image Registry Continuous Monitoring Containers Virtual

Assess the Current State, Including Misconfigurations Various sources such as CIS, DISA, USGBC, and vendor supplied best practice guides Examples: https://www.cisecurity.org/benchmark/amazon_web_services/ https://www.cisecurity.org/benchmark/docker/ Educate other stakeholders Review regularly

Assessment Extends Beyond CVEs To Include Application Vulnerabilities The OWASP Top 10 A1 A2 A3 A4 A5 XSS INJECTION (SQL, XXE & LDAP) BROKEN AUTH AND SESSION MANAGEMENT CROSS SITE SCRIPTING (XSS) BROKEN ACCESS CONTROL SECURITY MISCONFIGURATION A6 A7 A8 A9 A10 CSRF API SENSITIVE DATA EXPOSURE INSUFFICIENT ATTACK PROTECTION CROSS SITE REQUEST FORGERY COMPONENT VULNERABILITIES UNDERPROTECTED API

Analyze to Prioritize Remediation Based on Context: Cloud Services Example All cloud services are not created equal Cloud data or sensitive data? What data could be shared? Visible? What’s interacting with the cloud service? What subnets is it connecting to? Configuration issues?

Prioritize What to Fix Why reduce cyber exposure? Attack surface hardening Asset inventory Patch auditing

Prevent Vulnerabilities By Fixing Vulnerabilities Prior to Deployment Integrate security into the DevOps toolchain Identify and remediate vulnerabilities before they are exploitable Ensure all assets are secure and compliant before production

Category Description Goal Example Metric Attack surface hardening How exposed is my organization? Make attack surface as small as possible % exploitable vulnerabilities on internet-facing systems Asset inventory Do I know what needs protecting? Effectiveness at collecting accurate accounting of vulnerabilities – including for systems that require credentials % of systems discovered vs scanned in last 30 days Patch auditing Are my systems up to date? Effectiveness of patch process for security, feature/functionality, and warranty needs % of systems patched in last 30 days

Summary Assess Analyze Fix Measure IoT OT Cloud IT Discover Modern computing today is made up of both traditional and modern assets Don’t let either increase your cyber exposure Follow an operational security lifecycle: Discover – Assess – Analyze – Fix – Measure    

Technology Leadership Why Tenable 8 Technology Leadership Creator of Nessus and relentless innovator advancing modern cybersecurity – from IT to cloud to IoT and OT Singular Vision #1 Vulnerability Management technology in the world, pioneering Cyber Exposure to help customers measure & reduce cybersecurity risk Customer Commitment Complete dedication to our customers’ success – every day, in all we do

Top 10 US Financial Institutions Tenable at a Glance Founded in 2002 Exploded with the widespread adoption of Nessus and later, SecurityCenter Released Tenable.io in 2017 to introduce the first cyber exposure platform and evolve vulnerability management Relentless innovator: “Tenable has [massive] brand equity with Nessus, yet [is] one of the most forward-thinking companies in VM.” – Forrester, 2017 24,000+ Customers 1.6M Global Users 800+ Employees 50% 100% 80% Fortune 500 Top 10 US Tech Companies Top 10 US Financial Institutions

If you are flying blind to a widening Cyber Exposure Gap, that’s just untenable.