Cybersecurity Strategies for Effective Attack Surface Reduction

Editor's Notes

• #3: Secureworks is a leader in cybersecurity providing best-in-class cybersecurity solutions and threat intelligence that reduces risk, optimizes IT and security investments, and fills security team talent gaps. Secureworks Taegis™, a cybersecurity analytics cloud platform built on 20+ years of real-world threat intelligence and research, improves your ability to detect advanced threats, streamline and collaborate on investigations, and automate the right actions.
• #6: The term attack surface is often confused with the term attack vector, but they are not the same thing. The surface is what is being attacked; the vector is the means by which an intruder gains access. Your attack surface is the totality of all vulnerabilities in connected hardware and software. The combination of all attack vectors and all vulnerable assets within them is known as an organization’s attack surface. Attack vectors Specific paths that attackers use to gain unauthorized access to your environment. A simple analogy would be leaving a door or window to a building unlocked or open. While not always exploited, these openings provide an opportunity for unauthorized entry and therefore creates risk for malicious or unwanted activities that may take place. Common cyber-attack vectors include firewalls, DDoS attacks, malware, passwords, misconfigured APIs, and phishing – however organizations often have 100 or more attack vectors, adding lots of opportunity for risk. Protecting an organization requires careful review of every attack vector, and a detailed understanding of all assets associate with every attack vector, and what vulnerabilities exist in them. The combination of all attack vectors and all vulnerable assets within them is known as an organization’s attack surface. Your attack surface therefore reflects the entire area of IT infrastructure that is susceptible or exposed to potential compromise.
• #9: Vulnerability management. Prioritization, and Remediation. Attack surface reduction begins with an attack surface analysis. Vulnerability assessment tools are a core component of operationalizing attack surface analysis, automating the process of capturing a comprehensive list of know assets and any associated vulnerabilities associated with them. This list is constantly changing, so this process must be continuous to reflect an accurate view of potential risk. Attack simulation (pen testing, red teaming, etc.) – Expose externally-facing weaknesses. Attack Surface Management tools – automated assessment tools that identify and classify externally facing access to systems, data, and networks. Find assets and check for vulnerabilities. Continuously monitor and discover the external assets attackers can see and evaluate them against commercial, open source and proprietary threat intelligence feeds to generate security ratings for an organization's overall security posture. Risk assessment. Assessing potential risk associated with vulnerable assets requires an understanding of who or what systems are utilizing each asset, and what data is stored or processed on each asset. Risk prioritization. Once vulnerabilities and risk are assessed, both can be prioritized, focusing on highest-risk assets that need to be secured first. All of these processes must be operationalized – meaning that they must happen continuously, and automatically. Link to typical vuln definition…
• #16: - Software Vulnerabilities with CVE - Misconfigurations with CVE - Asset Exposures - Missing Security Patches - Security Control Deviations or Risk Exposures
• #17: - Software Vulnerabilities with CVE - Misconfigurations with CVE - Asset Exposures - Missing Security Patches - Security Control Deviations or Risk Exposures
• #19: What’s the talk track for this graphic?