Improving cyber resilience in a business context

While the goal of cyber security is to stop all attacks, 100% prevention is not possible. The truth is that an attacker only needs to find a weakness or vulnerability. The attack landscape that organizations must defend against is increasingly complex, and the threat landscape continues to expand rapidly – ​​making it impossible to prevent 100% of attacks.

While identifying and blocking threats is important, the real goal of cyber security is to ensure that cyber attacks do not disrupt operations and productivity. The first step to cyber resilience is understanding the business context of a breach: what business services are or may be affected and what it means to the business.

Under cyber siege

As organizations embrace and pursue digital transformation, the interconnected nature of applications, devices, users, and data flows that drive the digital enterprise creates complexity that increases the attack surface and results in operational inefficiencies. The impact of these relationships and dependencies can have costly consequences, including business interruption, unmet fines, remediation costs, loss of revenue and loss of reputation.

The aspect of the disaster is terrifying. There are more than 1 billion malware programs, and more than half a million new malware samples are discovered every day.

Ransomware has emerged as a major threat keeping IT security teams up at night. As of 2011 There have been several very high-profile ransomware attacks in early 2021, such as the attack on Colonial Pipeline, or the ransomware attack on Liberty College that forced the 157-year-old institution to close permanently. But organizations of all sizes and in all industries are crippled by ransomware attacks every day. Ransomware attacks targeting corporations increased 20% from 2019 to 2020—a 40% increase in the average cost of a ransomware incident.

Smart security strategy

Companies recognize that mitigating cyber risk is an increasingly important business imperative. The increasing number of malware, ransomware attacks and other cyber threats are having a significant impact on operations, resulting in costly disruptions to business.

To fight back, businesses are spending more of their annual budgets on security solutions. Unfortunately, those investments will not solve the problem. Despite these initiatives, 9 out of 10 security leaders believe their organizations are not adequately prepared to address cyber threats.

Spending more by itself does not improve cyber resilience. Mitigating risk is about understanding the overall nature of the attack, understanding the business context of the compromise (eg, is it part of a business-critical application or related to a critical application?) and identifying and taking action. Address gaps in defense. Where and how security investments are allocated is important.

Reducing cyber risk

Organizations must be able to effectively prioritize efforts to reduce the attack surface in the context of company-related business services. Hybrid and multi-cloud environments, combined with containers, Internet-of-Things (IoT) technologies, SaaS applications and digital supply chain concerns make this effort even more challenging.

A Cyber ​​Asset Attack Surface Management (CAASM) solution provides visibility into internal assets—typically through API integration with existing tools—to identify gaps in security controls and identify weaknesses in the security posture that need to be addressed and remedied. vArmour takes this a step further and provides insight into what many thought was impossible or extremely difficult to achieve: for any asset, in what application and therefore, to which business unit does that asset belong. Additionally, which critical applications relate to which asset? For example, knowing that a broken workload is part of a critical application for managing bank-to-bank SWIFT transactions will greatly inform the improvement plan.

If you want to build cyber resilience, you need to start with a map that unifies your entire enterprise digital estate. Because IT environments are constantly changing and evolving, timely snapshots are no longer sufficient. To effectively improve incident response and security controls, you need real-time, continuous management and inventory control of all assets, applications and users. Continuously mapping the attack surface allows you to identify gaps and understand dependencies in real time. vArmour offers a step-by-step approach to this visibility:

• Discover and view every application, any identity and connection (and data flows) in the enterprise environment to measure the overall attack landscape.
• Look at the interactions across all of these identities to establish a baseline for normal activity so you can identify unusual actions or behaviors.
• Establish and enforce consistent application-centric access control policies to natively enforce security across your existing infrastructure and applications.

vArmour automatically visualizes and maps the relationships and dependencies of all applications with consistent accuracy in months instead of months, versus current manual approaches that are resource-intensive, error-prone, and instantly obsolete. This insight is critical because it provides visibility into the entire attack landscape to help IT security teams mitigate cyber risk.

Understanding the business context of applications and their interactions is critical to effectively managing the attack surface. It reduces the chance of a successful cyber attack and improves cyber resilience for the organization, so IT security teams can sleep confident that the business will continue no matter what threats actors throw at them.