Economy Opinion Security Software

A better way to prioritise vulnerability management

 

 

Digital transformation offers enormous benefits, but equally increases the security threats faced. Continuous Threat Exposure Management, first coined by Gartner, is one of the most effective methods to combat these, says Patrick Evans, CEO at SLVA CyberSecurity

 

The past few years have witnessed a significant increase in digitisation across businesses and industries, driven largely by the changes wrought by the pandemic. Companies today are far more digitally interconnected than they were prior to 2020, as evidenced by the massive increase in remote working, as just one example.

 

While this has helped businesses gain new efficiencies and increase productivity, it has also opened these organisations up to new avenues of attack, as remote employees open up new potential vectors for cyber-criminals to exploit.

 

With hundreds of thousands of software vulnerabilities to manage in this digitally transforming world, it is simply impossible to protect a business from them all. In the past, remediation priority was often tied to Common Vulnerability Scoring System (CVSS) scores, which don’t consider what’s most important for your specific organisation, attack feasibility, active threats, and other aspects of security programs.

 

Now, research firm Forrester also suggests that relying solely on CVSS scores to prioritise remediations, is flawed because it is not only misaligned with the organisation’s strategic objectives, it also puts too much emphasis on potential, not actual, threats and inflates vulnerability severity.

 

The Forrester remediation prioritisation triad includes three primary elements you should consider when assessing vulnerability risk: threat likelihood, asset importance, and strength and effectiveness of compensating controls. Assessing each element improves the accuracy of assessing vulnerability risks and provides greater assurance that remediations are properly prioritised and not determined solely on CVSS scores.

 

Gartner recognised the need for a better approach, with the company’s Top 10 Security Projects for 2020-2021 report suggesting a risk-based vulnerability management approach. The best method of implementing such an approach is Continuous Threat Exposure Management (CTEM), as first coined by Gartner to describe a method that involves consistently exposing a company’s technologies – from networks and systems through to assets – to simulated attacks.

 

By continuously exposing the business assets to such attacks, CTEM is able to help IT managers identify vulnerabilities and weaknesses, enabling them to improve the enterprise’s overall security posture through the identification of security challenges, as well as the ability to act to address these – before the genuine criminals discover these weaknesses.

 

CTEM is even more critical when one understands that the sheer number of potential attack vectors and exploits means most organisations will likely only be in a position to remediate around 15% of their active vulnerability count.

 

Therefore, what is needed is a solution that allows security teams to obtain a view of all their current approaches, and help them to identify where the top 15% of these vulnerabilities lie. With this information in hand, businesses can prioritise these specific threats. And of course, when utilising a CTEM approach, this data is updated on a continuous and evolving basis.

 

Naturally, context is important. After all, while all businesses have vulnerabilities, their individual level of risk also depends on non-technological factors, like their specific industry vertical and even their geographical location. It is the understanding of such factors, within context, that is where the real threat intelligence lies.

 

With the right CTEM tool, IT managers are able to view a combination of external threat context, asset criticality, internal compensatory control and patch intelligence. Access to this data will enable them to proactively reduce their attack surface before it gets exploited.

 

A leading CTEM offering should be able to: show severe risks that might affect the organisation’s most critical assets and which require immediate patching; identify moderate threats to critical assets; indicate high risks to non-critical assets; and moderate risks to non-critical assets.

 

Ultimately, when looking to implement any kind of Vulnerability Prioritisation Technology (VPT) or Risk-Based Vulnerability Management (RBVM) solution, you should evaluate those vendor platforms that take telemetry data from other existing solutions such as vulnerability scanning data from Nessus, Qualys or Rapid 7.

 

After all, the missing component is the real-world threat intelligence around what active threat actor groups are doing now, or in the near future, and whether they are targeting your industry, or your geographic location, or both.

 

By offering a lens through which all these telemetry feeds can be correlated with your own patch intelligence – such as what has been patched and what hasn’t – it can provide your business with a risk-based view that bears no relation to the CVSS score, but rather considers the real world in which you operate.

 

A solution like this should be able to simulate the breach attack and test the efficacy of your compensatory controls.  In addition, this complete vulnerability management lifecycle approach will have the value of reducing your mean time to exposure [MTTE], an effective KPI for pre-emptive cybersecurity management.

 

In today’s digitally transforming world, ‘invulnerable’ is not a word any organisation can use to describe its security posture. While it used to be true that no single vendor provided it all, this is no longer the case. A good example of a vendor’s platform that delivers on the Forrester remediation prioritisation triad is Hive Pro’s Threat Exposure Management (TEM) solution, the value thereof can be quickly and effectively validated by submitting a dump of your organization’s vulnerability scan data as a proof of concept. You will be surprised at the vulnerability intelligence you receive back – it is eye-opening!

 

Faced with such a rapidly evolving threat landscape, it’s virtually impossible to address every risk. The best any IT manager can aim for is ‘well prepared’ – and utilising CTEM is currently the most effective means of achieving this status.

Leave a Comment

Your email address will not be published.

You may also like

Business Culture Economy Society Travels Trends

Lagos Governor Speaks on Expansion of Red Line Rail Service, Receives Mixed Public Reactions

post-image

 

By ANTHONY EMEKA NWOSU

The Governor of Lagos State, Babajide Sanwo-Olu, has unveiled a significant enhancement to the Lagos Rail Mass Transit (LRMT) Red Line as part of the state’s ongoing efforts to revolutionize urban mobility. Effective from tomorrow, the Red Line will expand its service schedule, now offering five morning trips and four evening trips daily, an increase from the previous two morning trips. This step is aimed at improving the daily commute for residents traveling along the high-demand route from Agbado to Oyingbo.

This upgrade promises to ease the stress of navigating the city’s notorious traffic jams by reducing overall travel times. With a journey time of just 50 minutes between Agbado and Oyingbo, commuters will benefit from the convenience of waiting times as brief as two minutes at each station. The increased frequency of train services is expected to significantly enhance the efficiency and reliability of the Red…

Read More
Business Culture Economy Tourism Travels Trends

Radisson Hotel Group concludes record-breaking year with over 300 new signings and openings in 2024

post-image

Radisson Hotel Group (www.RadissonHotels.com) reported a record-breaking year in 2024 after adding almost 40,000 keys to its global brand portfolio, thereby achieving significant milestones and further strengthening its footprint around the world. Radisson Blu remained the leading upper upscale brand in Europe for the 13th consecutive year and the Group is now leading the upscale resort segment in EMEA.

VIDEO
Elie Younes, EVP & Global Chief Development Officer, walks you through Radisson Hotel Group’s 2024 Business Development highlights

 

Elie Younes, Executive Vice President and Global Chief Development Officer at Radisson Hotel Group, comments: “Despite global geopolitical…

Read More
Business Economy Gadgets News Security Society Software Technology Technology Trends

Zoracom Announces Strategic Collaboration with Exeon Analytics AG to Enhance Cybersecurity Resilience and Next-Gen NDR Solutions

post-image

 

Zoracom, Nigeria’s foremost Network Security Operations Center (NSOC) and leading cybersecurity firm, has unveiled a groundbreaking initiative aimed at advancing Next-Generation Network Detection & Response (NDR) capabilities and bolstering cybersecurity operational resilience. The company revealed plans for a strategic visit to its partner, Exeon Analytics AG, in Zürich, Switzerland, scheduled for 2025, as part of its commitment to innovation and excellence in the cybersecurity landscape.

In an official statement, Zoracom emphasized that this collaboration underscores its dedication to addressing the evolving challenges of cybersecurity in an increasingly digital world. The initiative is designed to not only enhance Zoracom’s service offerings but also to provide cutting-edge solutions to its growing customer base, which includes enterprises, government agencies, and organizations across various sectors.

Key Objectives of the Initiative

The strategic partnership with Exeon Analytics AG, a renowned Swiss-based leader in cybersecurity analytics, is expected to deliver significant benefits, including:

  1. Support for a Growing…
Read More
Business News

Why Every Business Needs a Website and Social Media Management – Menxtt Technology NG is the Digital Partner You Can Rely On

post-image

 

 

Imagine a customer hears about your business and wants to learn more. The first thing they do? Search for you online. If they find nothing—no website, no social media page—chances are they’ll move on to your competitor. In today’s fast-paced digital world, businesses that lack an online presence are practically invisible.

That’s why Menxtt Technology NG, a trusted IT solutions provider based in Ikeja, Lagos, is helping businesses of all sizes build strong digital footprints. From creating professional websites to managing social media pages and deploying smart business software, Menxtt ensures businesses don’t just exist online but thrive in the digital space.

According to Anthony Nwosu, a marketing consultant at Menxtt Technology NG, going digital is no longer an option—it’s a necessity.

“Think about it—when was the last time you tried a new restaurant, salon, or service without first checking them out online? Today’s customers do their research before making a decision….

Read More
Agriculture Business

John Dumelo: “Agriculture Has Given Me More Than I Ever Dreamed Of”

post-image

Acclaimed Ghanaian actor and entrepreneur John Dumelo has shed light on his decision to step away from acting, citing agriculture as a more rewarding and impactful pursuit. Dumelo, who once graced the screens in some of Ghana’s most popular films, revealed that he left the entertainment industry to focus on farming, a venture that has transformed his life in ways he never imagined.

In a candid statement, Dumelo expressed that the film industry was financially unsustainable for him, prompting him to seek a more stable and fulfilling career path. His passion for agriculture, coupled with a strong desire to fight hunger in his community, led him to invest in large-scale farming.

“The film industry was not enough to sustain me. Besides, I had a deep passion for agriculture and a desire to eliminate hunger in my community and beyond through my products. This passion led me to venture into poultry farming,…

Read More
Business

NIMC Partners with Vice President’s Office to Advance Gender Inclusion at #SheIsIncluded Conference

post-image

 The National Identity Management Commission (NIMC) has reaffirmed its commitment to gender equality by actively participating in the Gender Inclusion Conference (#SheIsIncluded), organized by the Office of the Vice President of the Federal Republic of Nigeria.

The conference serves as a significant platform for addressing key challenges faced by women in Nigeria, including education, healthcare, economic empowerment, and leadership opportunities. With gender inclusion being a crucial factor in national development, the event aims to foster dialogue and policy recommendations that will create a more equitable society for women.

Speaking at the event, representatives of NIMC emphasized the critical role of identity management in bridging gender gaps. They highlighted the need for inclusive policies that ensure…

Read More
Business Entertainment Environment News

The World’s Fastest-Rising Startups Emerge on the AI Industry’s Grandest Stage

post-image

 

 

While Ai Everything Global welcomed capacity crowds for a second consecutive day, Wednesday was momentous for several reasons – including the emergence of the world’s fastest-rising startups. As the most reputable and iconic AI and big tech enterprises attracted substantial visitor numbers at the largest public-private global AI gathering of the year. As, so too did pure AI startups.

 

With over 250 early-stage international AI companies participating – 70% of which are certified award-winning – the Ai Everything Global Exhibition Showcase was the perfect platform for these top-rated startups to shine.

Booster Robotics of China received enormous praise and plaudits on its first-ever appearance in the UAE. The advanced humanoids creator has experienced a meteoric rise since its establishment in 2023, inventing the Booster T1, which has since gained international attention with its crowning as the ‘fastest free-walk robot’ at the 2024 IEEE-RAS Humanoids Championship.

Chaoyi Li, Head of Globalisation at Booster…

Read More
Announcements Business Culture Economy Education News

Girls in STEM Program Celebrates Record Success as 100% of Matric Cohort Passes Exams, Secures Scholarships

post-image

 

Subheadline: Melisizwe Computer Lab Project and e4’s Initiative Empowers Young Women to Break Barriers in Science, Technology, Engineering, and Mathematics

The Girls in STEM Awards Ceremony, held on 31 January 2025, celebrated the remarkable achievements of young women who have overcome challenges to pursue careers in science, technology, engineering, and mathematics (STEM). This year, the program achieved a 100% pass rate among its matric cohort, with many students earning scholarships and university placements in highly competitive STEM fields.

Launched in 2021 by the Melisizwe Computer Lab Project in partnership with e4, the Girls in STEM program aims to equip young women with the knowledge, mentorship, and confidence needed to excel in technology-driven industries. Over the past four years, the initiative has opened doors for participants, transforming academic potential into tangible success.

This year’s top achievers include:

  • Talitha Moosa, who scored 95% in Physical Sciences and 96% in Mathematics, and will study Actuarial…
Read More