Shifting Left in the Cybersecurity Defense Lifecycle

save
Share and earn Cybytes
Facebook Twitter Google+ LinkedIn Email

<p>Identifying your risk posture should be the first objective of all cybersecurity programs. Yet, this is where organizations often fail, due to weak visibility and understanding during the crucial “identify” phase of the cybersecurity lifecycle. Focusing on protect, detect, respond, recover without an understanding of risk posture leads to failed security strategies.</p>

<p>The cybersecurity defense lifecycle has a <a href=”https://www.nist.gov/sites/default/files/documents/2017/12/05/draft-2_fr… Framework</a> created for the purpose of helping organizations reduce and better manage cyber risks. It depicts the phases of a continuous lifecycle on a continuum like so: identify->protect->detect->respond->recover (Figure 1).</p>

<img src=”/sites/drupal.dmz.tenablesecurity.com/files/images/blog/Shift%20Left%20in%20the%20NIST%20framework.png” width=”975″ height=”138″ alt=”The NIST Cybersecurity Framework depicts the phases of a continuous lifecycle on a continuum like so: identify-protect-detect-respond-recover.” />
<p></i>Figure 1: NIST Cybersecurity Framework.</i></p>

<p>The cyber defense industry has had a huge focus in recent years on innovations relevant to the protect, detect and respond/recover aspects of this lifecycle. The <a href=”https://momentumcyber.com/docs/CYBERscape.pdf”>cybersecurity landscape</a> has been exploding with several hundreds of vendors (~500) in an ever-increasing number of areas and specializations. How do you know whether you need every one of these tools in your toolbox or just a couple? </p>

<p>It all starts with the “identify” stage, which begins with an initial understanding of your own risk posture that then develops into a more comprehensive risk management strategy with a focus on reducing your cyber exposure. This beginning allows for a measured response, rather than a spray-and-pray approach that is unlikely to yield the results you’re looking for. Understanding your own risk posture requires getting a continuously updated picture of your assets and information about the importance of those assets, and with a picture of the attack surface exposed by those assets directly or indirectly. Combining this level of insight with the risk introduced by humans — whether inside or outside your organization — gives you a much better picture of risk.</p>

<p>In the past, identification of assets was a relatively uncomplicated problem to solve. Your assets were physical assets that you knew, you could touch and, for the most part, they never left the building. As you move from that world into the world of BYOD, IoT, virtual machines, public cloud, containers and now serverless computing, those assets can be increasingly ephemeral and hard to discover and control. Furthermore, there’s been a significant increase in the sheer number of vulnerabilities over the past several years, with last year exhibiting a significant spike and this year on target to come close to or even exceed last year (Figure 2). The ever-changing elastic attack surface created by the evolution of assets from physical to increasingly ephemeral has created a massive gap in an organization’s ability to truly understand its Cyber Exposure at any given time. We call this the <a href=”https://www.tenable.com/cyber-exposure”>Cyber Exposure gap</a>.</p>

<img src=”/sites/drupal.dmz.tenablesecurity.com/files/images/blog/vulnerability%20distribution%20trends%20over%20time.png” width=”975″ height=”371″ alt=”Vulnerability distribution trends over time (Source: NVD)” />
<p><i>Figure 2: Vulnerability distribution trends over time (Source: NVD).</i></p>

<p>Recent high-profile breaches like Equifax, which was identified as being due to not patching an Apache Struts vulnerability for months, has led to significant focus on accelerating the time it takes to fix vulnerabilities across the corporate landscape. </p>

<p>This isn’t and hasn’t been an easy problem to solve for most organizations. The complexity of dealing with the vulnerabilities found in an organization has been increasing multiplicatively as a result of the sheer number of vulnerabilities across an ever-changing and expanding asset landscape. This is further complicated by having to consider the effect of a large variety of security products that could mitigate a vulnerability under specific circumstances and configurations. Last, but not least, is the fact that the process of fixing these vulnerabilities now also spans a variety of human owners and operators due to the varied nature of assets today.</p>

<p>In addition to the effort required to understand the current cyber exposure of an organization, future technology adoption decisions are also facing security considerations such as:</p>
<ul><li>Will adopting technology X increase risk and how do we mitigate it?</li>
<li>How do I keep a view of my ever-changing cyber risk posture so that I always know where to pay attention?</li>
<li>How do I become more proactive in closing the cyber exposure gap?</li></ul>

<h2>So, where should we start?</h2>

<p>The weakest spots in an organization’s security posture occur at the intersection of attack surface, avenues of attack (attack vectors) and obstacles/ (lack of) controls in place. Identifying these weak spots should be the first objective of all cybersecurity programs. This is also where several fail, due to weak visibility and understanding during that crucial “identify” phase. </p>

<img src=”/sites/drupal.dmz.tenablesecurity.com/files/images/blog/Cybersecurity%20finding%20the%20weak%20link.png” width=”975″ height=”404″ alt=”The weakest spots in an organization’s security posture occur at the intersection of attack surface, avenues of attack (attack vectors) and obstacles/ (lack of) controls in place.” />

<p>As a practice, we would all be better off with shifting further left in the lifecycle to address the right problems with the right solutions. That said, it isn’t enough to merely shift left at the start of your program for better cyber hygiene, it has to be an active part of your program, where it is revisited and continuously assessed.</p>

<p><b><i>Where are the top vulnerabilities found in the enterprise? Read the <a href=”https://www.tenable.com/cyber-exposure/vulnerability-intelligence”>Vulne… Intelligence Report</a> from Tenable Research to find out.</i></b></p>

Share this post and earn Cybytes
Facebook Twitter Google+ LinkedIn Email
Follow
1594 Followers
About Tenable
Tenable™, Inc. is the Cyber Exposure company. Over 24,000 organizations of all sizes around the globe rely on Tenable to manage and measure their modern attack surface to accurately understand and reduce cyber risk. As the creator of Nessus®, Tenable built its platform from the ground up to deeply understand assets, networks and vulnerabilities, extending this knowledge and expertise into Tenable.io™ to deliver the world’s first platform to provide live visibility into any asset on any computing platform. Tenable customers include over 50 percent of the Fortune 500, large government agencies and organizations across the private and public sectors. Learn more at tenable.com.
Promoted Content
Five Steps to Building a Successful Vulnerability Management Program
Is your vulnerability management program struggling? Despite proven technology solutions and the best efforts of IT teams, unresolved vulnerabilities remain an ongoing source of friction and frustration in many organizations. Regardless of how many vulnerabilities are fixed, there will always be vulnerabilities that can’t easily be remediated – and too often, finger-pointing between IT teams and business groups can ensue.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel