Shifting Left in the Cybersecurity Defense Lifecycle

Ram Venugopalan

<p>Identifying your risk posture should be the first objective of all cybersecurity programs. Yet, this is where organizations often fail, due to weak visibility and understanding during the crucial “identify” phase of the cybersecurity lifecycle. Focusing on protect, detect, respond, recover without an understanding of risk posture leads to failed security strategies.</p>

<p>The cybersecurity defense lifecycle has a <a href="https://www.nist.gov/sites/default/files/documents/2017/12/05/draft-2_fr... Framework</a> created for the purpose of helping organizations reduce and better manage cyber risks. It depicts the phases of a continuous lifecycle on a continuum like so: identify->protect->detect->respond->recover (Figure 1).</p>

<img src="/sites/drupal.dmz.tenablesecurity.com/files/images/blog/Shift%20Left%20in%20the%20NIST%20framework.png" width="975" height="138" alt="The NIST Cybersecurity Framework depicts the phases of a continuous lifecycle on a continuum like so: identify-protect-detect-respond-recover." />
<p></i>Figure 1: NIST Cybersecurity Framework.</i></p>

<p>The cyber defense industry has had a huge focus in recent years on innovations relevant to the protect, detect and respond/recover aspects of this lifecycle. The <a href="https://momentumcyber.com/docs/CYBERscape.pdf">cybersecurity landscape</a> has been exploding with several hundreds of vendors (~500) in an ever-increasing number of areas and specializations. How do you know whether you need every one of these tools in your toolbox or just a couple? </p>

<p>It all starts with the “identify” stage, which begins with an initial understanding of your own risk posture that then develops into a more comprehensive risk management strategy with a focus on reducing your cyber exposure. This beginning allows for a measured response, rather than a spray-and-pray approach that is unlikely to yield the results you're looking for. Understanding your own risk posture requires getting a continuously updated picture of your assets and information about the importance of those assets, and with a picture of the attack surface exposed by those assets directly or indirectly. Combining this level of insight with the risk introduced by humans -- whether inside or outside your organization -- gives you a much better picture of risk.</p>

<p>In the past, identification of assets was a relatively uncomplicated problem to solve. Your assets were physical assets that you knew, you could touch and, for the most part, they never left the building. As you move from that world into the world of BYOD, IoT, virtual machines, public cloud, containers and now serverless computing, those assets can be increasingly ephemeral and hard to discover and control. Furthermore, there’s been a significant increase in the sheer number of vulnerabilities over the past several years, with last year exhibiting a significant spike and this year on target to come close to or even exceed last year (Figure 2). The ever-changing elastic attack surface created by the evolution of assets from physical to increasingly ephemeral has created a massive gap in an organization’s ability to truly understand its Cyber Exposure at any given time. We call this the <a href="https://www.tenable.com/cyber-exposure">Cyber Exposure gap</a>.</p>

<img src="/sites/drupal.dmz.tenablesecurity.com/files/images/blog/vulnerability%20distribution%20trends%20over%20time.png" width="975" height="371" alt="Vulnerability distribution trends over time (Source: NVD)" />
<p><i>Figure 2: Vulnerability distribution trends over time (Source: NVD).</i></p>

<p>Recent high-profile breaches like Equifax, which was identified as being due to not patching an Apache Struts vulnerability for months, has led to significant focus on accelerating the time it takes to fix vulnerabilities across the corporate landscape. </p>

<p>This isn’t and hasn’t been an easy problem to solve for most organizations. The complexity of dealing with the vulnerabilities found in an organization has been increasing multiplicatively as a result of the sheer number of vulnerabilities across an ever-changing and expanding asset landscape. This is further complicated by having to consider the effect of a large variety of security products that could mitigate a vulnerability under specific circumstances and configurations. Last, but not least, is the fact that the process of fixing these vulnerabilities now also spans a variety of human owners and operators due to the varied nature of assets today.</p>

<p>In addition to the effort required to understand the current cyber exposure of an organization, future technology adoption decisions are also facing security considerations such as:</p>
<ul><li>Will adopting technology X increase risk and how do we mitigate it?</li>
<li>How do I keep a view of my ever-changing cyber risk posture so that I always know where to pay attention?</li>
<li>How do I become more proactive in closing the cyber exposure gap?</li></ul>

<h2>So, where should we start?</h2>

<p>The weakest spots in an organization’s security posture occur at the intersection of attack surface, avenues of attack (attack vectors) and obstacles/ (lack of) controls in place. Identifying these weak spots should be the first objective of all cybersecurity programs. This is also where several fail, due to weak visibility and understanding during that crucial “identify” phase. </p>

<img src="/sites/drupal.dmz.tenablesecurity.com/files/images/blog/Cybersecurity%20finding%20the%20weak%20link.png" width="975" height="404" alt="The weakest spots in an organization’s security posture occur at the intersection of attack surface, avenues of attack (attack vectors) and obstacles/ (lack of) controls in place." />

<p>As a practice, we would all be better off with shifting further left in the lifecycle to address the right problems with the right solutions. That said, it isn’t enough to merely shift left at the start of your program for better cyber hygiene, it has to be an active part of your program, where it is revisited and continuously assessed.</p>

<p><b><i>Where are the top vulnerabilities found in the enterprise? Read the <a href="https://www.tenable.com/cyber-exposure/vulnerability-intelligence">Vulne... Intelligence Report</a> from Tenable Research to find out.</i></b></p>

Read more >

Published on Nov 20, 2018

People also viewed

Customer Success Manager - ANZ

North Sydney Australia Pacific Highway, North Sydney, Australia, NSW 2060 Customer Success Sales
Your Role:Tenable has an immediate need for a Customer Success Manager who will be responsible for establishing and driving sales activities for our software products within a designated geography.Companies today are grappling with an ever expandi...

Finance & Investor Relations Intern

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Finance Internships
Your Role:Tenable has a Finance and Investor Relations Intern opportunity for college students entering their senior year or actively enrolled in an MBA program. If you're looking for a chance to apply what you're learning in your degree program, ...

Field and Channel Marketing Manager, Nordics and Benelux

Uxbridge United Kingdom Furzeground Way , Stockley Park, Uxbridge, United Kingdom, UB11 1EZ Field & Channel Marketing Marketing
Your Role:Tenable seeks an experienced field and channel marketing manager to generate demand for Tenable products and solutions across our Scandinavia and Benelux territories.  The successful candidate will have demonstrated experience creating, ...

Senior Data Engineer

Dublin Ireland Campshires, Sir John Rogerson's Quay, Dublin, Ireland Research Engineering
Your Role:Data Engineers here are involved in designing, developing and maintaining systems for data analysis, transformation, modelling and visualisation. We work directly with the data scientists to develop cutting edge uses of the data we colle...

Technical Support Manager

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Technical Support Technical Support
Your Role:Tenable is seeking a high energy, results oriented customer advocate capable of motivating an already exceptional support team to even higher levels of customer satisfaction. Our current global rating is over 93% satisfaction and we expe...

Cloud Security Intern

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Information Security Internships
Your Role: The Cloud Security Intern will help the Tenable secure their use of cloud systems across the company.  The intern will develop, implement and monitor security solutions for cloud that assess risk, keep Tenable data safe and bake in secu...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.