1 6 steps to a stronger security posture through automation Boost your cyber resilience to enable ongoing technology change with confidence 2 So many tools, so little time Remote work and the acceleration of digital transformation has pushed more companies to the cloud. This has expanded the attack surface of many organizations and has led to more expensive breaches according to the Ponemon Institute.1 Preventable errors like misconfigurations are also expected to become a leading cause of cloud breaches. So how do you effectively protect your organization? There’s no limit to the number of security tools on the market to help you harden your attack surface and thwart attackers. But just adding more tools isn’t enough. In fact, more tools often only create more alerts for staff to investigate—an additional challenge when security staff are in short supply. And many organizations are still using cumbersome spreadsheets to manage security hygiene. With so much to keep track of, prioritization is critical to know where to start, but a recent study by ESG Research found many organizations struggle with this. About 60% of organizations surveyed said they understand the importance of security hygiene but find it difficult to prioritize the right actions that can have the biggest impact on risk reduction.2 As the attack surface continues to grow, it’s not surprising that some teams are overwhelmed trying to keep up. To have a successful, proactive security program, you need to integrate the tools and teams involved to see the bigger picture and understand your risks. Workflows and automation can help you work effectively across teams to prioritize and remediate issues before they become a breach. Let’s look at six steps you can take for more efficient and effective attack surface hardening. 1 Ponemon Institute, Cost of a Data Breach, 2022 2 ESG Research Study, Security Hygiene and Posture Management, January 2022 of organizations surveyed said they understand the importance of security hygiene but find it difficult to prioritize the right actions that can have the biggest impact on risk reduction 61% 3 Step 1: Know what you need to protect Before you can get started, you need to know not just what you have, but what’s important. That means understanding your assets, services, software exposure, and dependencies. With the attack surface constantly changing, this is an ongoing effort. Therefore, you need a way to build out your configuration management database (CMDB) and keep it consistently updated, whether assets are on- premises or in the cloud. This isn’t practical for most organizations without automation, especially with dynamic cloud environments, as many are still using spreadsheets. You need to discover and keep up to date with all types of assets in your environment, including virtual machines, servers, storage, databases, applications, and containers. This should also include your external attack surface, like public-facing assets outside of your firewall that could be compromised to reach your internal resources. In fact, 69% of organizations surveyed experienced a cyberattack that started through the exploit of an unknown, unmanaged, or poorly managed internet-facing asset.3 3 ESG Research Study, Security Hygiene and Posture Management, January 2022 4 of organizations surveyed experienced a cyberattack that started through the exploit of an unknown, unmanaged, or poorly managed internet-facing asset 69% Assets then need to be classified to understand whether it’s a laptop, cloud application, operational technology (OT) device, or something else. If data is coming from multiple sources, you also need to be able to reconcile conflicting data or duplicates for an accurate inventory. Both a horizontal and top-down approach are necessary to identify upstream and downstream dependencies to know if something supports a critical service. This mapping will assist with prioritization of any issues found, as will knowing if an asset is subject to regulatory requirements such as HIPAA and PCI DSS.