Same cyberthreat, different story How security, risk, and technology asset management teams collaborate to easily manage vulnerabilities— within a workday 2 It is such a beautiful day in Half Moon Bay, California that I’ve decided to start work on my back patio to enjoy the fresh air and sunshine. I’m a senior IT security analyst for an enterprise software company in Santa Clara, but I can use all the tools of my trade remotely. That’s cool because I’ve got the flexibility to work from home whenever I want. It is a routine day so far–mostly P2 tasks–and I’ve just finished off my second cup of coffee. The French doors open, and my lovely wife appears. A moment I can't miss “Hiya Trev!” Aimee says, a little bit too enthusiastically for 8:17 a.m. “Remember, we need to be ready to leave by about 6 tonight. Courtney's thing starts at 7 and we should try to be in our seats by 6:45. Capeesh?” “Absolutely!” I reply. “No way I will miss seeing her on stage again.” Our daughter Courtney is a theater major at our local community college. She’d scored the lead role in the spring musical. Three years ago, she was also starring in a high school production, and I’d missed the only chance I had to see her–it was heartbreaking for me. The night of her performance, my team and I at my previous employer dealt with a P1 cyberattack that came in through unpatched software during the day. Addressing the breach was mostly a manual, chaotic process." Chapter 1 The bad old days " 3 The past haunts me The night of her performance, my team and I at my previous employer dealt with a P1 cyberattack that came in through unpatched software during the day. Addressing the breach was mostly a manual, chaotic process. Our recovery and remediation activities extended well past 10 p.m.—and long after my daughter had performed. My former organization, a prominent financial services company, was already hamstrung with a disconnected inventory of hybrid IT assets from at least 15 sources across multiple departments as well as a host of disparate tools to track those assets. It took about 90 staff hours just to generate an asset inventory. And it often took weeks of manual activities to identify and prioritize security vulnerabilities, patching needs, and compliance issues, then remediate them. And like too many organizations, the company failed to detect, track, or restrict shadow IT (often 40% of IT spending1) or prevent unsanctioned software. In fact, like 60% of organizations, they didn’t even include shadow IT in threat assessments, even though it accounts for 20% of all cyberattacks—with SaaS representing 45% of all incidents.2 Bad processes exposed Sure enough, a cyberbreach occurred because of a vulnerability in prohibited software that an employee had managed to download a week prior to the incident. The breach exposed the personal data for more than 280,000 customers. After that first night, it took 73 days of manual effort to fully address the breach–at a cost to the company of $3.2M in labor expenses, lost revenue, and a damaged reputation. But for me, the biggest loss was missing that great moment in my daughter’s life—the chance to see her excel at something she loves. Plus, I wasn’t the only one who missed family time—the whole team did! That was when I—and other employees— made the decision to start looking for a better job. Sure enough, a cyberbreach occurred because of a vulnerability in prohibited software that an employee had managed to download a week prior to the incident" " 3 The CyberS ecurity Tribune 4 With just hours to go before my daughter is to be on stage singing her heart out, my peaceful morning is interrupted by an alert on my smartphone. With a glance, I see that the risk team has assigned me to address two security incidents based on vulnerability issues. The tool the risk team uses for risk monitoring has already determined that the issues are a high priority because they could impact a significant percentage of our company. • Incident one involves additional processes detected in productivity software running on a server in the datacenter.