In the relentless battle against cyber threats, Attack Surface Management (ASM) has emerged as a vital tool for organizations seeking to protect their digital assets. However, the journey towards effective ASM implementation is fraught with challenges, particularly for smaller teams and organizations. In this blog, we delve into the intricacies of ASM, addressing the challenges faced by security professionals and exploring future directions for enhancing its efficacy.
Here is the verbatim discussion:
These are kind of connected so let me summarize like one one of the things which we discussed about so far is the attackers are attacking everybody on the internet I mean these attacks are becoming democratized especially with the ransom guys attacks have become lot faster right I mean unlike earlier today they can like scan the entire internet in a day and and find out vulnerable systems try to exploit so we got to be fast as well and then organizations as you mentioned don't know all the assets they have that I know unfortunately too well the the smaller the SMB the midmarket or the startups or even the small team in a large Enterprise uh you are overworked over requested um often not appreciated you are um generally trying to build a skill set but at the end of the week you're burned out from what you've just done the entire week and so you don't really want to look at a computer or pick up a book or listen to a podcast about something new that you have to learn so oftentimes in these overworked uh smaller teams the skill set I don't mean this in a bad way but it stagnates because that's really what it is they're they're working so much at work they're learning the things they have to learn to put out the fires in that moment they don't have the expertise or the skill set that is often missing and one of the the one of the primary skill sets that's often missing in a smaller team is the ability to triage a vulnerability that's been identified and appropriately decide what prior priority do I need to put on this what risk what risks does it create what new risks are there and do we have anything that's already going on that will mitigate this or what are our what are our mitigating controls that's something where I see ASM coming in because uh it takes that asset list that asset inventory which you know sounds really boring it's just the asset inventory sure service now has been doing that for 20 years but it doesn't have the security context around it and that's ASM it then takes that and says hey by the way there's these string of vulnerabilities on these assets that hey if an attacker figures this out it's going to be really bad you should go and take a look at this so that's what a good ASM does takes that asset list it applies wisdom or expertise to it that maybe your overwork staff doesn't have right now or they can't spend the time you know four hours pcing too many false positives too many alerts like wanted to know Chris your thoughts on how how how is the industry responding to that because that's one of the things which ASM has as a challenge like it throws just too many alerts a prioritization also right I mean as you mentioned prioritization false positives so what's your thought on this and what's the future like yeah and you know the the example of Legacy vulnerability management shows you what's broken it's it's noisy produces a lot of findings that are low confidence ASM can't do what that is doing it it it'll fail so ASM even though it discovers even more assets more broadly more comprehensively um through two methods of interaction with those remote assets either passive which is similar not the same but similar as the Legacy vulnerability management or active assessments meaning assets been identified okay now let's kick off some programmatic thing that's going to go out and interact with the asset and observe its behaviour.
Highlights:
Overworked Teams and Stagnant Skill Sets: Smaller teams and organizations often find themselves grappling with limited resources and overworked staff. Despite their best efforts, the relentless demands of day-to-day operations can hinder their ability to stay abreast of evolving security threats and technologies. Consequently, skill sets may stagnate, leaving teams ill-equipped to triage vulnerabilities effectively. ASM offers a beacon of hope in this landscape, providing automated insights and security context that augment the capabilities of overworked teams.
The Challenge of Alert Overload: ASM presents a unique challenge in the form of alert overload. With the ability to discover a vast array of assets and vulnerabilities, ASM may inundate security teams with a deluge of alerts, leading to alert fatigue and hampering prioritization efforts. Addressing this challenge requires a nuanced approach that balances the need for comprehensive visibility with the imperative of efficient alert management. Future developments in ASM solutions may focus on refining alert mechanisms and prioritization algorithms to alleviate this burden.
The Promise of Comprehensive Discovery: Despite its challenges, ASM holds immense promise in its ability to provide comprehensive visibility into an organization's attack surface. By leveraging both passive and active assessment methods, ASM can uncover assets and vulnerabilities that may have otherwise gone unnoticed. Furthermore, ASM's integration of security context and expertise enables it to prioritize vulnerabilities and recommend mitigating controls, empowering security teams to make informed decisions amidst the noise of alerts and false positives.
As the cybersecurity landscape continues to evolve, Attack Surface Management remains a critical component of organizations' defense strategies. While challenges such as alert overload and skill stagnation persist, ASM offers a path forward, providing automated insights and contextual intelligence that augment the capabilities of security teams. Looking ahead, the future of ASM lies in enhancing its ability to provide actionable insights, streamline alert management, and empower security professionals to navigate the complexities of the modern threat landscape with confidence and resilience. By embracing ASM as a cornerstone of their cybersecurity strategy, organizations can stay ahead of emerging threats and safeguard their digital assets effectively in an increasingly hostile environment.
Speakers:
Chris Ray, a seasoned professional in the cybersecurity field, brings a wealth of experience from small teams to large financial institutions, as well as industries such as healthcare, financials, and tech. He has acquired an extensive amount of experience advising and consulting with security vendors, helping them find product-market fit as well as deliver cyber security services.
Bikash Barai is credited for several innovations in the domain of Network Security and Anti-Spam Technologies and has multiple patents in USPTO. Fortune recognized Bikash among India’s Top 40 Business Leaders under the age of 40 (Fortune 40-under-40).Bikash is also an active speaker and has spoken at various forums like TiE, RSA Conference USA, TEDx etc.
Earlier he founded iViZ an IDG Ventures-backed company that was later acquired by Cigital and now Synopsys. iViZ was the first company in the world to take Ethical Hacking (or Penetration Testing) to
the cloud.
Comments