Beyond Vulnerabilities: Your Guide to Cyber Threat Exposure Management (CEM) & The Power of AI| EP 97

Today's episode offers a comprehensive overview of Cyber Threat Exposure Management (CTEM), defining it as a proactive framework for continuously evaluating digital and physical asset accessibility, exposure, and exploitability. It clarifies foundational cybersecurity concepts such as vulnerabilities, attack surface, threats, and impact, explaining how their interplay creates exposure. The speaker categorizes various types of exposure, from internet-facing systems to data leakage and phishing susceptibility, emphasizing the expanding attack surface due to interconnected IT infrastructure. Furthermore, the discussion elaborates on exposure management processes and related technologies, including vulnerability scanning, patch management, penetration testing, breach and attack simulation, and external attack surface management, alongside an explanation of how these tools are evolving to support a more unified CTEM approach. Finally, the transcript explores how Artificial Intelligence (AI) is enhancing CTEM through automated discovery, smarter prioritization, intelligent remediation, and enhanced automation.

Transcript

Hello everyone, welcome to the Cyberman show. Today's topic is CEM or cyber threat exposure management. So CEM is a program which has set of processes and capabilities that allow organizations to continuously and consistently evaluate the accessibility, exposure and exploitability of their digital and physical assets. Now that's the standard definition. Okay. But what we are going to do today is we're going to understand the background of how this technology is evolving. What is the current state of the technology? We'll also go into what led to uh CTM's current state also the trend in the current market and how AI is getting embedded in CTM to make it a very powerful combination. With that let's get started. Now before I get into CTM's uh uh core concept we have to understand the background and for that we have to go through some basic concepts uh things like exposure. So exposure refers to any instance where an organization systems data or network are susceptible to plat potential harm attack or unauthorized access from cyber threats. Right? So it's a it's a broader concept. It's just not about a individual weakness but how this these weaknesses which could be multiple combined with other factor practice can create an opportunity for an attack for a cyber criminal. Now the key aspects of cyber security involve the following things vulnerabilities attack surface threats impact and now let's look into each of them one by one. So vulnerabilities so these are specific weaknesses in software hardware or processes and exposure often arises when a vulnerability is present and accessible. Example could include unpass software, weak passwords or misconfigured system. So if somebody leaves a system with default password, it's easy for anyone to guess and they can get access to that system. If someone leaves a software unpatched, u a cyber criminal can exploit their system and get access to it and impact the CIA of uh that particular system. The second component of uh the exposure side is attack surface that refers to all the possible points where an attacker could try to enter or extract data from a system. A larger and more complex attack surface generally means greater exposure.

This includes internetf facing assets, user accounts, third party vendor connections, uh physical access point and could be many, right? It depends on the infrastructure of that organization in question. So, traditionally uh it would include uh endpoint joint and servers and then in in the modern enterprise it includes mobile data identity applications SAS uh apps, websites and uh now it could include IoT devices collaborations tool digital supply chain cloud workload cyber physical system your brand social media etc. Right? So the tax surface is expanding as IT infrastructure or phys infrastructure is more connected to the world, right? The next component is in exposure is threats. These are external or internal actors like hackers, malware or even neg negligent employees who have the intend and capability to exploit an exposure. A fourth component on exposure side is impact which is the potential damage or negative consequence if an exposure is successfully exploited. This range from financial loss and data breach to reputational damage and operational downtime. So how are these four things related. So vulnerability is specific flaw and exposure is the overall situation that puts something valuable at risk which could be exploited by a threat like a external hacker right and the impact could be the system going down. Okay so this is how the various concepts in exposure works right so let's look at various kind of exposures to make it even simpler this could include interfacing systems like servers, apps or devices that directly connect to internet without adequate protection. Second example of exposure could be misconfigured services in things like uh improperly uh configured uh cloud storage like S3 buckets or databases. Unpassed software which is running outdated software with known vulnerabilities. Weak or stolen credentials this includes easily guessable passwords, default passwords or credentials compromising previous breaches. Third party risk the include vulnerabilities in the systems of connected vendors or partners that can provide a back door into organization's network.

Now this uh for example in my previous organization in 2012 2012 there was a breach uh very well-known breach at RSA was conducted and a third party was involved as a uh entry point uh because of which the breach happened. The next exposure could be uh unsecured networks which includes open Wi-Fi networks or poor configured network devices. Another exposure type could be data leakage uh which is sensitive data being unintentionally exposed for example through misconfigured file sharing or public code repositories. So we keep uh coming up uh with these u kind of uh breaches uh uh in in last few years. Okay. Then uh also fishing susceptibility which is employees who might fall fall victim to fishing emails thereby providing attackers with access right? So as you would have understood by now there are bunch of ways to get into an organization because of the expanding attack surface ranging from your digital infrastructure to your employees uh and devices. Okay. Now what is exposure management then? So this is a process of identifying, assessing and mitigating potential vulnerabilities and threats to minimize the risk of cyber attacks. Okay. So essentially it's all about understanding uh what you have what are their weaknesses and how do you secure them. So how does this how does this work? You know it starts with asset discovery which is identifying um and making an inventory of all IT assets including those that might be exposed and a very common tool in this is vulnerability scanners. Okay so these are tools that identify software weaknesses or vulnerabilities in systems and applications. You might have heard of vendors like Teneable, Qualis, Rapid 7, very popular they've been there for decades, right? And related process to vulnerability scanning uh is uh one vulnerability management which is the process of continuously identifying, assessing, managing and remediating cyber vulnerabilities across application, workload and systems and typically security team will leverage a vulnerability management tool to find, fix and report on vulnerability.

The second related uh technology is patch management which is all about caping soft and systems up to date by fixing or patching the vulnerabilities using the software updates or fixes given by the OEM or vendor of that software. You you might have seen your systems getting updated, your apps getting updated both on mobile as well as on desktop operating systems and server operating systems of course. So this is part of uh patch management, right? So so far we have learned that uh to do exposure management you have to First identify the assets, perform vulnerability scanning. Uh another way of or another step in vulnerability management is penetration testing which is simulating cyber attacks that help identify these vulnerabilities or weaknesses across the infrastructure. These could be internal teams or external team, red team, blue team, purple team. I'll give you a homework. Go ahead and Google all these terms if you're not familiar with them. Another uh step in doing exposure management is breach and attack simulation. So, So uh this is a methodology that uh requires tools that simulate real world cyber attacks to test uh security measures or security efficacy of the current uh technologies including both prevention and detection systems. Uh and these systems have become really popular in last few years. The next thing in exposure management is uh doing uh an assessment of your external tax surface. So this is a category of tool called as ESM external tax surface management tools. that continuously scan and discover internetf facing assets including that might not be known to an organization's official IT inventory. Okay, you could call them shadow IT. Okay, this could include IP searchs, domain, cloud facing assets, exposed emails etc or credentials also. Okay, now what is then internal versus external attack surface management? So in the internal attack surface management the idea is to deal with threats and vulnerabilities that are from within the organization which is the infrastructure that you know of ESM is the outside in view or hacker's view where you identify and mon uh monitor risks associated with with the public facing digital footprint print that you might not might not know about.

So it often happens that developers uh start virtual machines uh that are connected to internet using their approved corporate uh cloud provider accounts and and cyber security teams might not know about them but then these uh systems get uh breached by hackers. Okay. Another component in exposure management is security awareness training which is about educating employees through cyber threats and lastly continuous monitoring which is actively looking for and responding to new threats and exposure. So here's summary of what we have learned. So exposure management is all about understanding various attack surfaces by using various tools uh to scan for them. Now let's look at those tools. Right? I've already mentioned EASM which is continuous process of uh discovering, analyzing, monitoring and mitigating the risk associated with public facing systems. Bunch of popular companies are there. This includes Polo Alto, Mandognto. The second category of exposure management tool is enterprise vulnerability management. This is uh doing a scan of your managed assets and uh finding vulnerabilities in them. M popular tools include teneable, rapid 7 and qualis. The third uh category of tool is cloud reliability management. These are new tools most when I say new I mean last four five years which is uh these tools allow you to continuously identify assess and prioritize and remediate security weakness and misconfiguration within uh organizations cloud computing environment. So these tools focus on the cloud uh workloads. Okay. This includes tools from viz orca now part Forinet and also Palo Alto. The next category is cyberware asset attack surface management. So these tools provide organizations with a unified comprehensive and continuously updated view of all the cyber assets. This essentially uh one source of truth for all your assets across the enterprise. Uh popular tools include Exonius Army's Jupiter 1. The last category in the exposure management tool is riskbased vulnerability management. This is another way way of looking at vulnerability management uh by prioritizing and fixing vulnerabilities based on actual risk that they pose to the organization than just uh technical severity.

So a typical vulnerability management scanner will tell you that these many assets have various sort of vulnerabilities and they will classify them into uh severity levels based on high medium low. There will be a vulnerability identifier like a CV ID. Uh but in uh RBVM risk this based vulnerability management the focus is to uh prioritize uh based on exploitability and the business impact. So it uses threat intelligence asset criticality to efficiently reduce on uh organization most significantly reduce security risk instead of just looking at thousands of vulnerability without no context of the organization into it. Right? So this is how various categories of tools have been helping in exposure management. Now some of you might think that it's a lot but that's a reality. Okay? There are a lot of tools that are used exposure management in any organization. Okay. Now, how does this all tie back to CEM? You must be wondering. So, let's look at let's go back to the CEM. Uh so, I gave you a definition. Now, here's a more updated uh definition. Uh which is a CM is a proactive framework designed to provide a consistent and actionable approach to managing an organization's threat exposure. Okay, let me simplify that for you. Okay, it's a grand unifi approach that integrates all your inputs from various things that I mentioned various tools uh to create a continuous business aligned uh security exposure. So it moves beyond vulnerabilities to include misconfiguration identity issues and other potential attack vectors. So imagine all those various kinds of exposures and how you get to know about them through various tools. Imagine all of them coming into one platform or one process that unifies all this prioritizes based on the business context and that's how teams stay ahead. So it's not reactive. This is all about proactive security. Okay. The idea behind CM is to strategically reduce the enterprises attack surface and better prepare against unpredictable threats. Now the CEM approach has five steps. So it's a continuous loop a circle that goes u uh in five steps. So these these steps include scoping, discovery, prioritization, validization, and mobilization. Okay. So what is scoping?

Scoping means identifying what is important for business. What is critical for business to function in terms of assets. Okay. Discovering is all about identifying digital assets and potential exposures. So what where are those doors and windows through which attackers can come. Okay. Scoping means uh which house is most important within discovering within that house what are the relevant doors and windows through which attackers can come or a thief can come. Prioritization is all about identifying exposure that pose the biggest risk. Okay. And how likely they are to be attacked and what the impact would be which is biggest door with the weakest lock. Okay. And if that person comes he lands up near my let's say the u safe carrying my jewels. Okay. Then um Validation is about validating if these exposure really uh are real and exploitable. Okay. So which is uh by uh the by confirming that attacker can really come through this can door uh in software terms it could be can the attacker really run an exploit and uh get in right so typically you will use a penetration testing or the breach and attack simulation platform to validate this and then mobilizing resources to fix the the most critical exposures quickly. In terms of the the house and the door analogy, this is all about uh ensuring that the door or window through which the thief could come. You have to implement enough locks, enough safety mechanism so that they can't get in. Okay. Uh the idea behind CM is to continuously shrink the attack surface and make it much harder for attackers to succeed. Right. So CM takes all the inputs which is what's important for business then keeps a continuous loop of discovering all those assets prioritizing them validating if really it's possible for somebody to exploit this weakness and then if there is a weakness automatically fixing uh the weakness okay now this is CM so far so what how's the market okay what's happening in the market right so one what I've realized is the existing vendors like tenel uh have been uh consolidating. So they are building platforms focused on uh expo uh various sort of exposure management technologies and all three vendors that includes tenable rapid 7 they are building that capability.

So Tenebel has now got a platform called teneal one that focuses on cloud exposure vulnerability exposure IoT exposure identity exposure etc. right similarly rapid 7 has a ESM platform vulnerability management platform a synapse uh to scan and simplified their workflows, right? And similarly, Exonius has built a platform for consolidating assets across uh various IT infrastructure technologies, understanding exposure, uh understanding identities, inventorying your SAS landscape, their risk, etc. Okay. So, all the existing large vendors on the vulnerability management side, they are building those capabilities to give their customers one platform to handle most of the use cases. Also, new vendors are getting entry. So, Polo Alto Viz had a very strong endpoint product, cloud security products. They've built exposure management capabilities. Uh either by acquisition or or internal buildout of these capabilities. Uh so, example, Palo Alto has expans uh they have vulnerability management capabilities both for known assets on our workstation as well as cloud from the Cortex cloud, Presma cloud capabilities. Uh Viz has uh also got similar capabilities on uh the uh cloud vulnerability management and workstation vulnerability management. Crowd Strike all similar capabilities. So these are large companies that have strong endpoint product and they built capabilities for ESM uh or acquired capabilities uh on other technologies related to exposure management. Right. So this is how the market is changing. I expect a lot of announcements coming from these vendors. So you we will see uh the same play large vendors adding these capabilities, existing vendors becoming more specialized uh giving uh more SKs and capabilities in their platforms. Okay. So this is how industry is evolving. Now lastly in terms of how AI is helping these companies is u AI can uh help in automated discovery and analysis. Uh so what that means is AI can discover newer asset faster uh by and analyze complex attack path that might be hard for humans to see.

I've seen examples where AI could u scan the asset exposed to internet understand the vulnerability of that uh uh asset in software terms check the connectivity if it is connected to internet not or not also fetch business criticality from uh cmdb database and then if that requires uh automatic handling it can create a ticket in a ticketing system like service now or automatically shut down a service based on the uh uh capabilities or even uh give uh recommendations from the product documentation. Uh right. The second thing that smarter prioritization uh uh we done with AI is that AI can analyze vast amount of data that includes vulnerability details, threat intel, business context, past uh attack patterns to more actually predict accurately predict uh which asset will might uh are more likely to get uh compromised. Okay. Similarly, intelligent remedation is the third capability that enhance that is enhanced by AI. So, AI can automate parts of remediation process like generating secure code configuration. And lastly, AI can help in enhance automation uh which includes adding more steps in the CM cycle from discovery to aspects of mobilization uh that can be completely automated and I'm are already examples of all this already in in the industry. Right? With that, thank you so much. I'm thankful to all the vendors who have mentioned in the podcast. Uh I learned from all of you and I'm thankful to all the listeners who keep giving feedback uh on LinkedIn, on YouTube comments as well as uh uh on uh Twitter. With that, thank you so much. I'll see you next time.