What is Exposure Management?

Exposure management is a cybersecurity practice used to continually map the network attack surface to detect and mitigate security risks in real time. Threat exposure management (TEM) insights allow companies to identify misconfigurations, overly permissive settings, and unintended exposure paths that conventional vulnerability management practices don’t even consider. 

Shrinking the cloud attack surface

Attack surfaces are the combination of all potential attack vectors cybercriminals use to gain unauthorized access to a particular environment. While bad actors continually search for weaknesses in cloud attack surfaces, exposure management continually shrinks this attack surface by providing the visibility needed to prioritize risks and take appropriate actions.

Management tools and practices identify these conditions through automated cloud environment scanning, mapping, and analysis. Siloed data and visibility gaps are replaced by actionable data and visualizations. 

• Changes in the cloud: With service delivery architectures continuously evolving, the cloud environment can change significantly within minutes. Automation has only compounded the pace of change owed to human, system, and design factors. The agentless technology and advanced automation utilized for exposure management are essential for keeping up with this rapid pace of change and detecting configuration issues that can leave critical assets exposed.  
• Cloud interdependencies: The best exposure management tools utilize comprehensive, end-to-end graphical tools to map interdependencies and highlight risks from an attacker’s perspective. Cross-account access can produce new attack vectors when cloud accounts with overly permissive settings provide a pathway to other accounts. Threat exposure management tools interpret these complex interdependencies as part of the detailed attack path analysis. 
• Prioritization: Prioritized lists of vulnerabilities, configuration issues, and other risk factors allow organizations to systematically mitigate issues that impact the attack surface hardening their environment and applications. Exposure levels and the value of at-risk assets are among the factors weighed to ensure the highest risks are addressed first.  

Exposure management in the cloud is a relatively new practice, and one that is likely to evolve and expand as more companies adopt this proactive approach and recognize the benefits. As a starting point, the exposure management lifecycle can be broken into distinct phases that are repeated to improve readiness and reduce risk.    

• Baseline exposure levels: Taking stock of exploitable assets and baselining previously identified attack paths and cloud interdependencies are logical first steps. An accurate assessment of asset value also leads to more meaningful threat prioritization. This includes physical, digital, and cloud-based assets requiring protection.  
• Understand adversaries: Thinking like your adversary is a hallmark of effective exposure management. To do this, you must know who your potential adversaries are, what tools and resources are at their disposal, and what motivates them to pursue your assets. Understanding the tactics, techniques, and procedures (TTP’s) of likely adversaries allows organizations to fine tune their exposure management strategy.  
• Quantify exposure: A complete security assessment provides a detailed list of exposure paths and a hop-by-hop accessibility analysis for essential assets. An exposure assessment identifies weaknesses in the attack surface by reviewing the relationships between exposure paths, vulnerabilities, and configurations. Security and exposure assessments feed into the initial prioritization of threat mitigation activities.  
• Improve cybersecurity posture: Once the exposure paths, weaknesses, and vulnerabilities have been identified, continuous improvement can begin. During the improvement phase, scorecards become an important tool for reviewing exposure and vulnerabilities in real time. Operationalized diagrams give the entire team visibility into the full cloud stack.  

How to Build a Threat Exposure Management Program

As your organization progresses through the exposure management lifecycle, you will begin to establish a TEM program that addresses the unique cybersecurity needs and goals of your business.

Important factors to consider as you build a TEM program include:  

• Assessing current technologies: What cybersecurity tools do you currently deploy and how effective are they? How can exposure management replace or supplement the existing toolkit? Answering these questions will help you integrate TEM as part of a holistic cloud security strategy.
• Identifying visibility gaps: Are you able to visualize the cloud environment from the attacker’s perspective? Penetration tests, vulnerability scans, and other commonly deployed tools don’t fully account for the complexity of the cloud environment. Exposure management helps organizations progress from siloed security findings by improving visibility into various points of entry and exploitable pathways. 
• Establishing metrics: The metrics chosen to support exposure management are essential building blocks for the program and should include exposure and vulnerability data quantified in high-level scorecards. Real-time access to these metrics positively impacts mean time to resolution (MTTR) and the bottom line. 
• Communicating progress: Threat exposure management metrics are also useful for communicating the value and effectiveness of TEM to management and other key stakeholders. Effective communication also ensures resources are allocated to address the most critical cloud security risks.

Gartner Research identified continuous threat exposure management (CTEM) as a top priority for CISOs in 2023. In recognition of the ever-changing cloud environment, CTEM expands upon exposure management practices by continuously monitoring attack surfaces and assessing vulnerabilities. Key steps in the continuous threat exposure management cycle include:   

• Scoping of the attack surface including all servers, endpoints, cloud infrastructure, and integrated supply chain systems. CTEM scoping includes the external attack surface as well as software as a service (SaaS) application. 
• The CTEM discovery process is used to identify additional assets, vulnerabilities, and misconfigurations that were not considered during the initial scoping process. An initial risk assessment based on the current IT security posture should also be completed. 
• Threat prioritization is subject to frequent adjustment, but establishing initial criteria is a key CTEM deliverable. Along with the asset value and risk tolerance of the organization, prioritization algorithms should consider the availability of compensating controls. 
• Validating attack pathways identified through TEM helps you determine whether they are viable risks to the organization. The validation process is used to simulate attacks under real-world conditions to determine how the system would react.  
• Mobilization of resources for continuous threat exposure management is focused on the indispensable human element. Automation is being called upon to remediate a growing number of configuration issues, but team participation, collaboration, and training are needed to eliminate obstacles and optimize responses.  

Potential Cost of Not Performing Exposure Management 

With the average cost of cloud account compromises for an organization reaching $6.2 million annually, addressing endpoint vulnerabilities one by one is no longer a viable strategy. Cybercriminals rely on overly permissive settings or poor cyber hygiene coupled with unmitigated vulnerabilities to deploy dangerous ransomware and spyware. Exposure management allows you to guard against attacks proactively, even in today’s highly dynamic threat landscape.  

Competitive pressures can also lead to third-party container application vulnerabilities and critical assets that are externally exposed. Cases of cloud exploitation and data breaches are on the rise. This makes improved visibility into attack paths and interdependencies essential when prioritizing remediation activities. Exposure management allows you to think like your adversaries to diminish their power.  

The VIAVI Observer Sentry Threat Exposure Management solution analyzes and maps cloud environments to identify where assets are exposed. Sentry’s intuitive views highlight misconfigurations, overly permissive settings, and risky combinations of exposure paths and vulnerabilities.  

• Software-as-a-service based TEM gives SecOps, DevOps, and Cloud Architects full visibility into ever-changing cloud environments. An agentless approach allows you to scan multiple environments simultaneously. 
• Advanced graph-theory algorithms lead to intuitive cross-environment diagrams and help you visualize misconfigurations and unintended exposures more easily.  
• Insightful scorecards provide a snapshot of system health and exposure levels for each application, logical asset grouping, workload, or environment. 

Observer Sentry is part of the VIAVI Network Performance Management and Threat Solutions portfolio, and the Observer Platform.  

What are the Key Benefits of Exposure Management? 
Exposure management improves an organization’s security posture by enabling a more proactive approach. The cloud attack surface is continually reduced to stay two steps ahead of adversaries. A unified, graphical view of the attack surface also improves visibility and awareness throughout the organization. Risk-based prioritization and reporting tools are additional benefits of threat exposure management.      

What is the Difference Between Exposure and Vulnerability? 
Vulnerabilities are exploitable weaknesses found in individual devices or machines due to conditions like outdated operating systems or unpatched applications. Exposure refers to circumstances that provide access to vulnerabilities, such as overly permissive settings or configuration issues. While it is important to eliminate device, system, and network vulnerabilities, it is equally important to detect and eliminate the pathways that leave these vulnerabilities exposed to attackers.   

What are Some Exposure Management Challenges? 
Monitoring and safeguarding the attack surface are key objectives of exposure management, but the sheer volume of data and the complexity of the cloud environment can make these goals elusive. Advanced automation, agentless technology, and machine learning are among the tools being deployed to meet these challenges. Exposure management also requires an organizational shift to move away from entrenched, reactive threat and vulnerability management processes.