Closing the Security Gap with ASM: Start with Complete Visibility

Information Technology (IT) and Information Security (IS) teams have a number of predetermined steps and workflows in place for threat detection and response. Unfortunately, these workflows are often limited by common factors and are not as seamless or effective as they could be with the right tools in place. In fact, many IS and IT teams don’t even know that there are gaps in their threat detection and response workflows until they bring in an Attack Surface Management (ASM) solution.

Let’s take a look at typical threat detection and response workflows, analyze their gaps, and explore how integrating ASM from the start maximizes workflow success.

Security team workflows

Tried-and-true security workflows have been developed and standardized, and many security teams follow some or all of these pre-existing workflows so as not to reinvent the wheel. One of the most prominently followed threat detection workflows is the SANS workflow, developed by the SANS Institute. This is a six-step workflow that consists of:

1. Setting up monitoring for all sensitive IT systems and infrastructure
2. Analyzing events from multiple sources including log files, error messages, and alerts from security tools
3. Identifying an incident by correlating data from multiple sources, and reporting it as soon as possible
4. Notifying response team members and establishing communication with a designated command center
5. Documenting everything that incident responders are doing as part of the attack
6. Threat prevention and detection capabilities across all main attack vectors

This workflow alone, while renowned among security professionals, does not contextualize the possibility that even the most sophisticated cybersecurity solutions cannot find exposed assets in unknown environments. How can security teams identify the major gaps that this can create in their workflows?

Gaps in typical workflows

Typical security team workflows can have major gaps that leave private company and customer data exposed to attacker exploitation. These gaps can result in:

• Not identifying certain threats
• Identifying threats too late
• Identifying threats but not understanding their locations and therefore how to resolve them
• Unnecessary costs of integrating many different vulnerability tools
• Disorganized and scattered response workflows

What are the different threat detection and response workflow gaps that can occur? Here are some of the most common workflow gaps.

Limited visibility. Security teams are often unable to view the full scope of their attack surfaces, and therefore are unaware of existing or looming threats. Many organizations primarily target the size of the attack surface, which results in security professionals being tasked with identifying ways to reduce the attack surface. While attack surface size and the areas that are vulnerable are important factors, the biggest threat to the attack surface is not its size but its visibility.

Integration costs. IT and IS budgets need to be carefully managed and justified. In the effort to bring in many different tools that perform overlapping tasks, teams can end up spending unnecessary costs integrating several different vulnerability solutions into their workflows.

Disorganized workspaces. Many security teams are just trying to keep up with the deluge of threats that they can detect, and they don’t have a sufficient workspace within which to efficiently organize work. Even though it takes time to organize the work, it actually slows down processes by not having an organized system and missing crucial steps.

How ASM fills the gaps in security workflows

Attack Surface Management is an essential part of the security team arsenal that can fill the gaps in threat detection and response workflows. How does ASM fill in the gaps?

Cloud visibility

With its growing adoption and complexity, the cloud is one of the hardest environments to keep track of. Censys partnered with Forrester to assist a Fortune 100 in its attack surface visibility. The company was confident they had assets in only nine cloud accounts, but after running ASM, it was revealed they had assets in 23 active cloud accounts. ASM gives teams visibility into all cloud environments that contain both known and unknown assets.

Compliance issues

The more complicated the Internet becomes, the more compliance legislation and standards are put into place for the protection of both companies and their customers. With all the changing standards, it can be challenging for security teams to ensure they are in a constant state of compliance. ASM helps security teams stay on top of privacy and security compliance standards by becoming immediately aware of any potential threats and asset exposures.

Distributed workforce

In a post-pandemic world, companies in every industry and on every continent are heading in the direction of remote and distributed workforces. While technological advances have made this kind of working model possible, it is also more difficult to secure devices from all over the world. Attack surface management vendors empower remote teams to achieve the same efficiency of threat detection and response as in-person teams through heightened visibility into every corner of the Internet and cloud.

The Value of Censys ASM

The attack surface management solution takes the advantages of ASM for security team workflows and magnifies it to the highest level.

• Visibility of shadow IT: Shadow IT is a major source of unknown assets that could be threatened. Censys ASM prioritizes teams’ visibility into shadow IT, alerting professionals to instances of shadow IT that need heightened attention.
• Investigation, exploration, and prioritization: Censys ASM takes the deepest dive into 100% of the Internet and cloud to not only identify risks, but also, understanding industry and company initiatives, prioritizes them in a strategic and efficient way. This gives professionals the time to mitigate risks in an order and approach that makes sense for your organization without wasting time on discovery and prioritization.
• Automated discovery: Periodic asset monitoring and discovery are no longer sufficient, as many risks can’t afford to wait a month or even a week to be resolved. Discovery with Censys is constant and ongoing, and teams receive alerts any time an asset or threat is identified for quick decision-making and remediation.
• Workspaces: Censys ASM’s feature, Workspaces, empowers security teams to get organized and make your company’s attack surface work for you and your top priorities. With our ASM platform and Workspaces, keeping your perimeter secure only requires that you act on the risks reported to you through the platform.

Get complete visibility in your workflows with Censys ASM

Even the most comprehensive and thoughtful threat detection and response workflow is incomplete if it lacks complete visibility into every asset. Censys ASM gives security professionals the power to transform unknown assets into known assets and assess their security.

To learn more about the benefits of ASM for workflows and see your attack surface in real-time, request a demo with Censys.

Get a Demo