The constant paradigm shift regarding business dynamics brings a wide range of hazards closely related to the scope of the technological platform that each company handles.
In other words, the broader is the network architecture of your company (and here we make direct reference to your BYOD and BYOT policies) to interact through the cyberspace; the broader should be the scope and analysis of your cyber exposure.
Now, are you familiar with the concept of cyber exposure? Let’s look into this new approach.
Basic concepts on Cyber Exposure
To fully understand the scope and purpose of cyber exposure, we must first understand what attack vectors are. Do you know what they means regarding cybersecurity?
They are basically the routes that hackers use to achieve a targeted attack. In other words, attack vectors are the methodology used to exploit system vulnerabilities.
It is worth mentioning that many hackers exploit more than one vector attack to achieve their goals; and this usually translates into losses for your business.
Cyber Exposure index
As you may figure out, it consists of a range of data describing the features of cyber attacks accomplished primarily through data disclosure and credential exposure.
Such features expose the modus operandi of hacker group targeting, and thus; the company’s cyber exposure index is determined by classifying risks exposed in a range of 5 to 0 in a certain period of time. Let’s go deeper into this index.
Cyber Exposure Index Variables
As recently mentioned, consists of three main factors:
Sensitive Disclosure
Although laws and policies regulate confidential information and in principle, sensitive data should never be stored locally on hard drives; or portable devices; or emailed without proper authorization; all of these cases are regular practices. As result; internal breaches open up to rise to risk of sensitive disclosure.
In such scenario, attack vectors are sniffing, phishing/whaling; and the result may vary from identity theft to data manipulation or theft (business plans, company valuation, trade secrets); and ransomware attacks.
Exposed Credentials
On the other hand, this practice has plenty followers among hackers who want to test themselves and gain recognition and popularity among peers. It consists of decoding and disclosing credentials and user names, passwords and combinations to access to private data and systems.
Also, the biggest advantage that hackers have to exploit this system vulnerability is the known practice of users to recycle passwords; and using their personal data for their creation. Similarly to sensitive disclosure, exposed credentials may rise the exploitation of internal breaches to steal or hijack sensitive data and open the window to the fearful ransomware.
Hacker group targeting
Anonymous is the first name that comes to mind when talking about hacker group targeting. Regardless of the color of their hats or the interests they may pursue, the fact is that members of these groups put their knowledge at the service of terrorism.
So, a group of hackers who converge in geniuses and power focused in the destruction of a targeted group; understanding as targeted group a list of companies with specific features specifically chosen to be destabilized or even neutralized.
As methodology or attack vector; hackers set and start their activity with a public manifesto that discloses and explains the reasons behind their actions followed by their targeted attacks lists deliberately chosen. However, the specific modus operandi and precise date of their strikes remain secret to preserve the surprise element to magnify their scopes.
Risk Classification
In terms of cyber exposure, risk classification variables are:
Clear text passwords
In fist place we found clear text passwords rank as high risk because almost 50% of the users reuse their passwords.
Hashed passwords
Following, hash type passwords or hashed passwords rank as medium risk. While they are difficult to decipher, there are precedents and case studies that diminish their effectiveness.
Targeted attack lists
Finding the name of an individual on a targeted attack list can be daunting; however, it supposes a significant low threat in statistical terms.
This is because most of the time, the actual attack rarely takes place and limits to the sole attempt. For reasons linked to the cost/investment ratio, most individuals do not suffer a real attack; which results in low risk classification.
Conversely, risk increases almost in 100% when an organization’s name appears on a targeted attack list. Again, the real consummation of the attack is subjected to so many variables that leaves a considerable gap between threat and achievement; so for a company being on a targeted attack list ranks as a medium risk.
Sensitive Disclosure
In the case of companies, sensitive disclosure ranks as mid level risk due to the unauthorized disclosure of sensitive data (such as internal documents, emails and code sources) rises to 50% the chances of being stricken by a cyber attack.
How companies classify into the Cyber Exposure index?
Each company gets cyber exposure score based on the variables and risks to which they expose to. Exposure scores fall into 6 categories:
Category 5
Businesses in this category are in the 1% highest cyber exposure risk. In other words, they are companies with security protocols and tracking virtually nil.
Category 4
This category includes companies in 25% of cyber exposure risk. Among these companies count those who although they have security systems, do not count on well-defined protocols to follow.
Category 3
Companies in this category fall in 50% of cyber exposure risk with increasing trend. These companies have systems and monitoring protocols, but with marked deficiencies that may increase the risk of exposure.
Category 2
This category gathers companies with 50% of cyber exposure risk with decreasing trend. This group generally gathers companies with systems that meet digital security and monitoring protocols in ongoing consolidation.
Category 1
Companies in this category are at 25% of cyber exposure risk. It gathers companies with consolidated culture in terms of digital security, and reports minimal failures.
Category 0
Businesses in this category have an impeccable record of no exposure to risks in the last 12 months.
How to mitigate the impacts of the attacks by using cyber exposure?
Cyber Exposure is a new approach to control assets. It amends and supplements the traditional view of security and protection of corporate assets. This vision integrates live and real time following of all your assets either IoT; mobile and/or static devices; local, Cloud-based and hybrid network elements.
From this live image, you start to accurately assess and analyze your assets from a new approach based on exposure and risk. As a result of this new approach to business assets, you obtain more reliable critical data based on your business information security maturity and your capability to respond to threats to prioritize immediate solutions.
Now, do you know which tool can give you the complete picture of your company regarding cyber exposure? Tenable.io is. Come and discover with us more of their advantages.
