How external attack surface management lets you see your org through an attacker’s eyes

>>Don’t miss our particular difficulty: How Information Privateness Is Reworking Advertising and marketing.<<

It’s not an overstatement: The Log4j vulnerability shook the cybersecurity world. 

One of the vital cyber incidents in latest reminiscence, it was revealed in December 2021 when researchers recognized a distant code execution exploit within the Apache Log4j library. 

Billions of units have been put in danger and hundreds of thousands of assaults have been tried (and profitable) — one oft-cited early discovering was that there had been tried exploits on greater than 44% of company networks worldwide. 

Specialists say these numbers are undoubtedly far increased, and that we’ll by no means actually know the complete extent of the impacts. 

However the shockwaves proceed, and an rising methodology to deflect them is exterior assault floor administration (EASM), which is actually and approaching your group the best way an attacker would. 

EASM instruments allow organizations to see, perceive and handle all of the methods an attacker would possibly get into your group.

To bolster this course of, EASM firm CyCognito in the present day introduced the following technology of its Exploit Intelligence (EI) device. This new iteration of its platform is provided with Sandbox Digital Lab, which the corporate calls an industry-first built-in exterior assault floor sandbox testing surroundings. 

“EASM is now not a ‘good to have,’ it’s now a ‘should have,’” mentioned Phillip Wylie, hacker-in-residence at CyCognito. “We have to be vigilant and be always monitoring and testing our environments. It could’t be an annual or biannual perfunctory vulnerability scan or pen check.”

Simulating an assault

An exterior assault floor is all of a corporation’s IT property — information, apps and networks (on-prem or in cloud), and subsidiary, third-party or companion environments and people intently associated to the group — as seen by attackers wanting in from the skin. Managing that’s one of the best ways to make sure you keep safe, mentioned Wylie. 

CyCognito’s up to date EI device offers info on find out how to validate a vulnerability and learn the way an adversary would exploit it. This introduces a few of the advantages of penetration (pen) testing into its EASM platform. 

“Pen testing is vital as a result of it assesses the safety from a menace actor perspective,” mentioned Wylie. “We use the identical strategies malicious hackers do to achieve entry to delicate info. This out-of-the-box pondering is utilized by menace actors and takes into consideration eventualities that typical cybersecurity finest practices typically overlook.”

He identified that CyCognito doesn’t carry out a pen check; it’s extra of a vulnerability evaluation. This entails all of the steps of a pen check, minus the exploitation (that’s, hacking). EI offers steps to seek out weak property and study if and the way an adversary would possibly compromise them, in addition to what the potential impacts could possibly be. 

Then, it permits safety groups to simulate post-exploitation actions similar to privileged escalation or information exfiltration. It additionally allows repeat asset testing to make sure correct patching.

“It permits safety groups to take that theoretical assault information and gauge its influence on their very own exterior assault floor and even simulate an assault,” mentioned Wylie. “It does this with out requiring the abilities of a pen tester.”

Log4j: Nonetheless pervasive

The preliminary launch of Sandbox Digital Lab focuses on Log4j, however in coming months will help extra simulations round Log4Shell, ProxyShell, ProxyLogon and ZeroLogon threats. 

As Wylie defined, when Log4j hit, the CyCognito crew was heads-down in serving to clients patch. Subsequently, they realized that instruments fixing for future threats like Log4j required a testing surroundings to simulate how an adversary would exploit a particular asset. 

Log4j stays so vital and pervasive as a result of so many purposes use it of their tech stack, mentioned Wylie.

Some software program requires patches to be put in to resolve Log4j vulnerabilities, and typically that will get neglected. Additionally, patches and upgrades can typically reintroduce vulnerabilities, he defined.  

Current CyCognito analysis discovered that 70% of organizations that had beforehand addressed Log4j of their assault floor are nonetheless struggling to patch Log4j weak property and forestall new cases of Log4j from resurfacing inside their IT stack. 

Some organizations are even seeing their Log4j publicity improve: 21% with weak property skilled a triple-digital share progress within the variety of uncovered Log4j weak property in July in comparison with January. 

“So, it’s not solely vital to repeatedly replace software program, however to even be assessing purposes to ensure they aren’t weak,” mentioned Wylie. 

EI leverages Cybersecurity and Infrastructure Safety Company (CISA), FBI and different menace intelligence sources (together with adversary exercise). 

The pairing of CyCognito’s discovery and mapping engine and EI offers data that’s actionable — versus simply information feeds — in order that safety groups can construct, check and deploy fixes and prioritize mitigating highest-risk property, mentioned Wylie. EI integrates with SIEM/SOAR, ticketing instruments and remediation workflows to offer proof and mitigation steerage. 

Key options embody: 

• Remediation acceleration: Highest-risk exploitable property in an exterior assault floor are shortly recognized. This may cut back response and remediation timelines from months to days. 
• Fast-impact evaluation: A targeted map paints an image of all property doubtlessly in danger, together with these already protected and people nonetheless weak.
• Identification possession: The invention engine determines asset possession to shortly determine who’s chargeable for fixing weak property.

“CyCognito’s Exploit Intelligence fills a spot between menace intel and vulnerability administration,” mentioned CEO Rob Gurzeev. “The addition of Exploit Intelligence doesn’t simply hyperlink vulnerabilities to particular property, however solutions the vital query of why it is very important prioritize fixing particular property instantly due to their attractiveness to energetic attackers.”