Traditional approaches to cybersecurity are reactive in nature, therefore reducing security risk presents a challenge in today’s modern dynamic landscape of frequent code changes, new exploits and zero-day attacks. New threats and vulnerabilities appear every day, so patchwork is never fully complete.
Typical techniques such as automated scanning, while useful for alerting to suspected vulnerabilities, do not specifically validate exploitable and actionable vulnerabilities present in a specific environment. Meanwhile compliance driven security assessments occur too infrequently to keep up with the latest threats.
Every major organization invests in reactive cyber defense, yet the news is filled with stories about organizations being breached. By now even organizations with high quality security practices realize that it’s not a matter of if, but when they will be exploited by bad actors.
Understanding Cyber Resilience
Building proactive cyber resilience is a paradigm that focuses on how to bounce back more quickly when exploits inevitably manifest themselves. By learning from mistakes, rather than simply reacting to them, organizations can improve cyber resilience, improve cyber defenses and reduce risk over time.
Building cyber resilience requires a multi-pronged continuous approach. Security assessment is needed to gain an understanding of the current state of cyber risk in an organization’s environment (e.g. NIST 800-171 compliance requires such assessments).
How to Build Cyber Resilience
Proactive security testing should be conducted by experts, to find as many exploitable vulnerabilities as possible before bad actors do. Testing may not catch 100% of security gaps, but every one it catches in advance frees up time and resources to properly work malicious breaches if or when those slip through.
Triage and vulnerability prioritization needs to be coordinated with DevOps backlog creation so that high-impact remediation can occur before vulnerabilities can be re-exploited. At this stage security monitoring and controls can be adjusted to better detect and prevent future breaches.
Follow-up is key. Organizations are routinely breached by previously identified vulnerabilities that were never addressed. A critical threat may have been detected and blocked, but its root cause is left open to recurrence. Oversight of implementation of fixes and verification of patch efficacy are critical but are often overlooked.
Teams and tools that detect security gaps may be different than those tasked with fixing them, without proper communication and integrated processes crucial remediation actions can unknowingly be missed. A cyber resilient program seeks to institutionalize follow-up and process improvement on a continuous basis.
Synack and Microsoft Security have joined forces to implement a program that prioritizes cyber resilience. The program supplements routine vulnerability scans with human-driven security assessment, threat hunting, and remediation, for an agile continuous approach which results in strategic changes to operational processes, reducing risk over time.
Want to learn more about the joint program? Read our cyber resilience solution guide.
