ICYMI: Exposure Management Academy on Attack Surface Management, Proactive Security and More

Each Monday, the Tenable Exposure Management Academy provides the practical, real-world guidance you need to shift from vulnerability management to exposure management. In this post, we look back on the guidance and best practices shared in the past several months. You can read the entire Exposure Management Academy series here.

Let’s look back at key takeaways from the Exposure Management Academy over the past several months, including ones that address: 

• Attack surface management and visibility
• The shift in mindset required to move to proactive exposure management
• Exposure context and prioritization based on business impact
• Fostering a culture of shared responsibility for managing and remediating exposures

Attack surface visibility and management

Consider this question that you’re bound to get several times a week (if not daily): Where are we exposed? To provide an answer, you need a complete understanding of your organization’s attack surface, including all possible entry points that a threat actor could use to launch an attack. 

As Aaron Roy wrote in Understanding Your Attack Surface: The Key to Effective Exposure Management, every application, server, cloud instance and employee laptop connected to the internet is a part of that surface. But unlike physical inventory, the digital attack surface is not static. It’s an amorphous and constantly expanding environment that has undergone significant changes in the wake of the move to remote work and the proliferation of connected devices. Plus, every new technology (think cloud, AI and more) forces even more change. 

To deal with this, modern security teams have had to quickly adapt. Running periodic vulnerability scans isn’t enough these days. 

So, what can you do in the face of this change? 

Modern security teams need to take a more holistic approach with a continuous discovery process that maps the entire landscape. That means finding assets you didn’t even know you had, including the ever popular forgotten servers and shadow IT that can become gaping holes in your defenses. 

By meticulously identifying and mapping the entire attack surface, cybers

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.