Cyber Defense eMagazine March Edition for 2022

into the mix. The COVID-19 pandemic ravaged families, business communities, and economies around
the globe. Those enterprises that moved decisively, migrated to the cloud almost overnight and instantly
expanded the attack surface.
The problems came from several different directions. First, employees working from home were using
unvetted personal devices that potentially contained a smorgasbord of vulnerabilities. These devices
used private and third-party networks to connect to the cloud-based environments required for remote
work. And corporate data, sensitive or not, was crossing unknown boundaries on its journey between the
WFH employee and the corporate environment. Penetration testing became unreliable because the
architecture being probed was half in and half out of an organization’s jurisdiction.
Second, DevOps teams – desperately trying to transform massive chunks of their employers’ business
models to adapt to the new normal – were releasing new digital experiences at the speed of demand.
These releases could, depending on circumstances, contain any number of security holes picked up from
new PaaS environments.
Rethink your digital dogma
As has been said at many points throughout cybersecurity history, what we were doing two years ago no
longer works. Threat actors have proved themselves capable of using every trend, every market shift,
every consumer habit, and every employee error to their advantage. Responses from organizations have
not been as swift. While cybersecurity professionals can never quite recall a “quiet past”, the “stormy
present” of 2022 requires a rethink of our digital dogmas if we are to ensure that employees can stay
safe but remain productive.
The starting point: know yourself. Line of business will always have a handle on financial plans,
operations, market conditions, and a range of other touchpoints. For IT and security teams to be
successful, they must compile a comprehensive asset inventory – from the machines in the office to the
devices in employees’ homes, from the tools on laptops to the inner workings of containerized apps in
the cloud.
Next comes triage. Identifying vulnerabilities is trivial next to the task of managing action. Some
vulnerabilities will be common but may not represent great damage if they were to be exploited. Others
may be rare but represent considerable business risk. The general rule of thumb is that if a vulnerability
can cause significant damage and is relatively easy to exploit by an attacker, it should be high on the
patching list. Anything that is high-risk and not readily addressable should be on a watch list.
Free to innovate
All of this, from the compilation of the asset inventory to the patching actions, should be automated where
possible. Several tools today are capable of automatic asset discovery and policy-based patching.
Overworked CISOs and their embattled teams represent the most overlooked security issue in the post-
Cyber Defense eMagazine – March 2022 Edition 40
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.