Economy Opinion Security Software

A better way to prioritise vulnerability management

 

 

Digital transformation offers enormous benefits, but equally increases the security threats faced. Continuous Threat Exposure Management, first coined by Gartner, is one of the most effective methods to combat these, says Patrick Evans, CEO at SLVA CyberSecurity

 

The past few years have witnessed a significant increase in digitisation across businesses and industries, driven largely by the changes wrought by the pandemic. Companies today are far more digitally interconnected than they were prior to 2020, as evidenced by the massive increase in remote working, as just one example.

 

While this has helped businesses gain new efficiencies and increase productivity, it has also opened these organisations up to new avenues of attack, as remote employees open up new potential vectors for cyber-criminals to exploit.

 

With hundreds of thousands of software vulnerabilities to manage in this digitally transforming world, it is simply impossible to protect a business from them all. In the past, remediation priority was often tied to Common Vulnerability Scoring System (CVSS) scores, which don’t consider what’s most important for your specific organisation, attack feasibility, active threats, and other aspects of security programs.

 

Now, research firm Forrester also suggests that relying solely on CVSS scores to prioritise remediations, is flawed because it is not only misaligned with the organisation’s strategic objectives, it also puts too much emphasis on potential, not actual, threats and inflates vulnerability severity.

 

The Forrester remediation prioritisation triad includes three primary elements you should consider when assessing vulnerability risk: threat likelihood, asset importance, and strength and effectiveness of compensating controls. Assessing each element improves the accuracy of assessing vulnerability risks and provides greater assurance that remediations are properly prioritised and not determined solely on CVSS scores.

 

Gartner recognised the need for a better approach, with the company’s Top 10 Security Projects for 2020-2021 report suggesting a risk-based vulnerability management approach. The best method of implementing such an approach is Continuous Threat Exposure Management (CTEM), as first coined by Gartner to describe a method that involves consistently exposing a company’s technologies – from networks and systems through to assets – to simulated attacks.

 

By continuously exposing the business assets to such attacks, CTEM is able to help IT managers identify vulnerabilities and weaknesses, enabling them to improve the enterprise’s overall security posture through the identification of security challenges, as well as the ability to act to address these – before the genuine criminals discover these weaknesses.

 

CTEM is even more critical when one understands that the sheer number of potential attack vectors and exploits means most organisations will likely only be in a position to remediate around 15% of their active vulnerability count.

 

Therefore, what is needed is a solution that allows security teams to obtain a view of all their current approaches, and help them to identify where the top 15% of these vulnerabilities lie. With this information in hand, businesses can prioritise these specific threats. And of course, when utilising a CTEM approach, this data is updated on a continuous and evolving basis.

 

Naturally, context is important. After all, while all businesses have vulnerabilities, their individual level of risk also depends on non-technological factors, like their specific industry vertical and even their geographical location. It is the understanding of such factors, within context, that is where the real threat intelligence lies.

 

With the right CTEM tool, IT managers are able to view a combination of external threat context, asset criticality, internal compensatory control and patch intelligence. Access to this data will enable them to proactively reduce their attack surface before it gets exploited.

 

A leading CTEM offering should be able to: show severe risks that might affect the organisation’s most critical assets and which require immediate patching; identify moderate threats to critical assets; indicate high risks to non-critical assets; and moderate risks to non-critical assets.

 

Ultimately, when looking to implement any kind of Vulnerability Prioritisation Technology (VPT) or Risk-Based Vulnerability Management (RBVM) solution, you should evaluate those vendor platforms that take telemetry data from other existing solutions such as vulnerability scanning data from Nessus, Qualys or Rapid 7.

 

After all, the missing component is the real-world threat intelligence around what active threat actor groups are doing now, or in the near future, and whether they are targeting your industry, or your geographic location, or both.

 

By offering a lens through which all these telemetry feeds can be correlated with your own patch intelligence – such as what has been patched and what hasn’t – it can provide your business with a risk-based view that bears no relation to the CVSS score, but rather considers the real world in which you operate.

 

A solution like this should be able to simulate the breach attack and test the efficacy of your compensatory controls.  In addition, this complete vulnerability management lifecycle approach will have the value of reducing your mean time to exposure [MTTE], an effective KPI for pre-emptive cybersecurity management.

 

In today’s digitally transforming world, ‘invulnerable’ is not a word any organisation can use to describe its security posture. While it used to be true that no single vendor provided it all, this is no longer the case. A good example of a vendor’s platform that delivers on the Forrester remediation prioritisation triad is Hive Pro’s Threat Exposure Management (TEM) solution, the value thereof can be quickly and effectively validated by submitting a dump of your organization’s vulnerability scan data as a proof of concept. You will be surprised at the vulnerability intelligence you receive back – it is eye-opening!

 

Faced with such a rapidly evolving threat landscape, it’s virtually impossible to address every risk. The best any IT manager can aim for is ‘well prepared’ – and utilising CTEM is currently the most effective means of achieving this status.

Leave a Comment

Your email address will not be published.

You may also like

Business Economy

The Art of Investment: The rise of African art (By Ngozi Akinyele)

post-image

By Ngozi Akinyele, Chief Marketing and Communications Officer, Coronation Group (www.Coronation.ng)

 

A diversified portfolio is one of the key metrics of investment success. The greater this diversity, the more likely it will outperform the market, and the savviest investors are often looking for new opportunities: the rising stars among new asset classes. Investment in art is certainly not a new concept, but what makes it unique is that it often has low correlation with other major asset classes, meaning lower overall price volatility (https://apo-opa.co/3UpJknE). It’s the sure bet, sometimes with incredible escalating value, especially for those opting to invest in blue-chip artists (https://apo-opa.co/3Uq6YQQ) renowned artists whose work demands high prices in the art market).

However, not all of us can afford to invest in the works of Picasso, Van Gogh, or Warhol, with many blue-chip pieces only accessible as…

Read More
Business Culture Economy

From Tech Addiction to Surviving Conflict: Global Conference in Doha Explores the Challenges Facing Arab and Global Families

post-image

Policies to protect families in countries affected by conflict, the global impact of population decline, and striking a balance between work and family life were placed in focus at the 30th Anniversary of the International Year of the Family Conference on Family and Contemporary Megatrends.

 

Organized by Qatar Foundations Doha International Family Institute (DIFI), in partnership with the Ministry of Social Development and Family, the Ministry of Foreign Affairs, and the United Nations Department of Economic and Social Affairs (UNDESA), the conference brought together more than 2,000 experts and policymakers from around the world to explore key trends affecting families, and policies and programs that strengthen the familys place at the heart of society.

 

The conference was attended by eminent figures from across the Arab world including Her Excellency Shanaz Ibrahim Ahmed, First Lady of Iraq; Her Excellency Maya Morsi, Minister of Social Solidarity, Egypt; Her Excellency Dr. Amthal Hadi Hayef Al…

Read More
Business Economy Education Government Investments Technology Technology Trends

Nigeria Secures N2.8 Billion Google Investment to Boost Digital Economy and AI Development

post-image

 

Dr. ‘Bosun Tijani, the Minister of Communications, Innovation, and Digital Economy, announced a significant N2.8 billion commitment from Google, aimed at accelerating Nigeria’s digital economy through strategic initiatives outlined in the ministry’s Strategic Blueprint. The announcement was made alongside Google’s President of EMEA Business & Operations, Matt Brittin, as the tech giant pledged to support Nigeria’s technological transformation.

Dr. Tijani highlighted four major initiatives that Google’s investment will fuel:No alternative text description for this image

  1. DeepTech Ready Upskilling Programme: Designed to enhance advanced technical skills, this program aligns with Nigeria’s 3MTT initiative, aiming to equip 20,000 Nigerians with expertise in Data Science and Artificial Intelligence (AI).
  2. Experience AI Programme: Targeting young learners aged 11-14, this initiative, co-developed with the Raspberry Pi Foundation and Google DeepMind, seeks to introduce AI fundamentals across Nigerian schools. Through this program, Google will train 25,000…
Read More
Business Culture Economy

Sanâa Kiadi Reflects on Participation in IOM Workshop on Migration Data in Rabat, Morocco

post-image

Sanâa Kiadi, a distinguished Global Strategist and International Executive, recently had the honor of representing the African Migration Observatory (AMO) at the Sub-Regional Workshop on Migration Data and Research, which took place on October 16th and 17th in Rabat, Morocco. This significant event was organized by the International Organization for Migration (IOM) in collaboration with the Government of Morocco, bringing together key stakeholders dedicated to advancing the understanding of migration dynamics in the region.

During her participation, Kiadi presented AMO’s mission, which is focused on enhancing migration data collection and analysis across Africa. Her presentation underscored the importance of establishing robust data systems that inform evidence-based migration policies. “Accurate and comprehensive migration data is essential for shaping policies that address…

Read More
Business Economy Energy Environment Government

Rivers State Governor Sim Fubara Shuts Down NNPC and Oil Companies, Proclaims “No Allocation for Rivers State, No Oil for Nigeria”

post-image

In a bold and unprecedented move, Rivers State Governor Sim Fubara has ordered the shutdown of the Nigerian National Petroleum Corporation (NNPC) and all oil companies operating in the state. His declaration, “No allocation for Rivers State, no oil for Nigeria,” reflects a deep frustration over what he perceives as the unfair distribution of oil revenues.

This decisive action has sent ripples through the nation, resulting in Nigeria’s global oil production ranking plummeting from 4th to 24th almost immediately. Governor Fubara’s stance not only puts the spotlight on the importance of Rivers State to Nigeria’s oil supply but also raises questions about the broader implications for the economy and energy sector.

In a heartfelt challenge to influential leaders, including Minister Nyesom…

Read More
Business Economy News Opinion

The business case for automating customer due diligence and FICA compliance

post-image

By Sameer Kumandan, MD of SearchWorks

 

Automation has been labelled as a way to tighten up the corners, without cutting them. An apt description, it’s all about using technologies to up productivity, boost efficiency, reduce errors and save businesses a lot of time without having to make any sacrifices when it comes to quality or performance.

 

Customer Due Diligence (CDD) plays a critical role in mitigating financial crime risks by helping businesses establish that their customers are not involved in illegal activities and that they are who they say they are. In addition, CDD is essential to ensure compliance with South Africa’s Financial Intelligence Centre Act (FICA). And it’s not a one-time activity. Ongoing monitoring is vital to keep close tabs on how a customer’s circumstances and activities change over time. This is important, because risks evolve over time and because of the rise of what

Read More
Business Culture Economy Health

The Heart of Moppet Foods: How Loyal Customers Like Marian Are Building a Nigerian Brand Together

post-image

 

When Roberta Edu launched Moppet Foods, a locally-produced baby food brand, she hoped parents across Nigeria would find value in a nutritious, homegrown option for their babies. But what she didn’t expect was the level of passion and loyalty she’d see from her customers—people who believe in her brand so deeply that they’ve become its unofficial guardians.

Recently, Edu shared a story about one of her most devoted customers, Marian, who lives in Akoka and buys Moppet baby food from the Justrite store in Bariga. Marian’s dedication goes far beyond simply picking up a carton of baby food; she’s become almost a part of the Moppet team. “The way she looks out for us—it’s something I can’t even describe,” Edu said.

Marian has taken it upon herself to monitor Moppet’s stock levels at the store, as if the brand were her own. Every time she’s at Justrite, she’ll check the shelves,…

Read More
Announcements Business Culture Economy

Umo Eno: Akwa Ibom Embarks on 18-Storey Ibom Towers Project in Lagos to Drive Economic Diversification

post-image

 

Akwa Ibom State has launched a notable development initiative outside its borders, breaking ground on an 18-story building, the Ibom Towers, in Lagos. The project has stirred discussions around its location, with some questioning why the state would invest in infrastructure outside Akwa Ibom. Governor Umo Eno clarified the motivation behind the decision, describing it as a strategic move aimed at diversifying Akwa Ibom’s economy and establishing new revenue sources.

Speaking at the groundbreaking event, Governor Eno stated, “Today, as part of our efforts to diversify Akwa Ibom’s economy, we marked the groundbreaking of the 18-story Ibom Towers in Lagos. This project, expected to be completed in 24 months, will drive substantial revenue growth and economic ties between Akwa Ibom and Lagos States.”

The governor extended gratitude to Lagos State Governor Babajide Sanwo-Olu, who led the ceremony, as well as to former Akwa Ibom Governors Udom Emmanuel, CON, and Obong Victor…

Read More