Cyber Exposure – The Next Frontier

1. Cyber Exposure – The Next Frontier Kevin Catalano | Territory Manager TasJalali| Security Engineer

2. TOPICS • Today’s IT is creating a cyber exposure gap • Who’s affected? • How to reduce your cyber exposure gap

3. Digital Transformation is Accelerating • Every organization is transforming into an information organization • Putting pressure on every function to innovate and operate faster • “Bold, tightly integrated digital strategies will be the biggest differentiator between companies that win and companies that don’t.” • – McKinsey & Co.

4. How Are You • Responding? • What is the organization’sdigital strategy? • How is Security enabling thatstrategy?

5. The Attack Surface is Expanding ICS/SCADA Industrial IoT Enterprise IoT IoT Cloud Container Web app Virtual machine Mobile Laptop Cloud Network infrastructure Server Desktop IT

6. Creating a Cyber Exposure Gap ICS/SCADA Industrial IoT Enterprise IoT IoT Cloud Container Web app Virtual machine Mobile Laptop Cloud Network infrastructure Server Desktop IT

7. Cyber Exposure is an emerging discipline for: Managing and measuring your modern attack surface to accurately understand and reduce your cyber risk

8. Why? Discovering Short-Lived Assets is Hard Request Deploy Patch Retire

9. Why? Assessing State of Cloud Environments is Hard Visibility 8% • ...companies that know the scope of shadow IT at their organizations, according to a survey by the Cloud Security Alliance Compliance • 48% • ...of organizations store some sensitive data, like employee records, in the cloud according to a SANS Security in the Cloud report Consistency • 31% • … of respondents in the same SANS report found poor configuration practices in place due to applications being spun up quickly

10. Why? Maintaining Application Security is Hard Sources: • TechRepublic, “Report: 99.7% of web apps have at least one vulnerability,” June 20, 2017 • White Hat Security, “2017 Application Security Statistics Report,” July 2017

11. Who’s Affected?

12. New Stakeholders and Asset Owners Will Impact an Organization’s Cyber Exposure Container Cloud OT / IoT OT Manager, Engineer Line of Business DevOps OT assets are becoming an expansive attack surface Shadow IT and cloud assets are creating a huge blind spot DevOps velocity requires new security approaches

13. Security Teams Need to Provide Strategic Insight and Manage Risk Across The Organization • Reduce risk across a growing modern attack surface Security Director OT Manager, Engineer DevOps Line of Business • Increase SOC efficiency • Maintain regulatory compliance • Secure DevOps processes • Decrease costs to fix defects • Protect brand equity • Gain strategic decision support on risk

14. Addressing the Full Cyber Exposure Lifecycle Identify and map every asset for visibility across any computing environment Assess Analyze Fix Measure Discover Model and analyze cyber exposure to make better business and technology decisions Understand the state of all assets, including vulnerabilities, misconfigurations and other health indicators IT IoT Prioritize which exposures to fix first, if at all, and apply the appropriate remediation technique Understand exposures in context, to prioritize remediation based on asset criticality, threat context and vulnerability severity OT Cloud

15. Discover Every Asset container mobile virtual public cloud web app desktop laptop server

16. Assess the Current State, Including Misconfigurations • Various sources such as CIS, DISA, USGBC, and vendor supplied best practice guides • Examples: • https://www.cisecurity.org/benchmark/amazon_web_services/ • https://www.cisecurity.org/benchmark/docker/ • Educate other stakeholders • Review regularly

17. Assessment Extends Beyond CVEs To Include Application Vulnerabilities The OWASP Top 10 A1 A2 A3 A4 A5 XSS INJECTION (SQL, XXE & LDAP) BROKEN AUTH AND SESSION MANAGEMENT CROSS SITE SCRIPTING (XSS) BROKEN ACCESS CONTROL SECURITY MISCONFIGURATION A6 A7 A8 A9 A10 API CSRF SENSITIVE DATA EXPOSURE INSUFFICIENT ATTACK PROTECTION CROSS SITE REQUEST FORGERY COMPONENT VULNERABILITIES UNDERPROTECTED API

18. Analyze to Prioritize Remediation Based on Context: Cloud Services Example • All cloud services are not created equal • Cloud data or sensitive data? • What data could be shared? Visible? • What’s interacting with the cloud service? What subnets is it connecting to? • Configuration issues?

19. Prevent Vulnerabilities By Fixing Vulnerabilities Prior to Deployment Integrate security into the DevOps toolchain Identify and remediate vulnerabilities before they are exploitable Ensure all assets are secure and compliant before production

21. Summary Modern computing today is made up of both traditional and modern assets Don’t let either increase your cyber exposure Follow an operational security lifecycle: Discover – Assess – Analyze – Fix Assess Analyze Fix Measure Discover IT IoT OT Cloud

22. Why Tenable 8 Technology Leadership Creator of Nessus and relentless innovator advancing modern cybersecurity – from IT to cloud to IoT and OT Singular Vision #1 Vulnerability Management technology in the world, pioneering Cyber Exposure to help customers measure & reduce cybersecurity risk Customer Commitment Complete dedication to our customers’ success – every day, in all we do

23. Tenable at a Glance • Founded in 2002 • Exploded with the widespread adoptionof Nessus and later, SecurityCenter • Released Tenable.io in 2017 to introduce the first cyber exposure platform and evolve vulnerability management • Relentless innovator:“Tenable has [massive] brand equity with Nessus, yet [is] one of the most forward-thinking companies in VM.” – Forrester, 2017 24,000+ Customers 1.6M Global Users 800+ Employees 50% 100% 80% Top 10 US Financial Institutions Fortune 500 Top 10 US Tech Companies

24. If you are flying blind to a widening Cyber Exposure Gap,that’s just untenable.