Your Patches Aren’t Your Shield: Transitioning to Exposure Management

Patching is tactical, but exposure management (EM) is strategic. 

Just like many patches don’t make one great shield, total cybersecurity depends more on a solid suit of armor than arbitrary fixes (that might not even be calculated to parry the next blow).

What holds more value? Applying patches simply because they’re in your backlog? Or gaining a comprehensive view of your attack surface and understanding what to tackle first? 

Companies today recognize that cybersecurity underpins business value. As such, it needs to be approached in a forward-thinking way. That’s exposure management—and it’s quickly replacing piecemeal patches in enterprise security strategies.

What Is Exposure Management in the Context of Business?

Exposure management in cybersecurity is the process of gaining optimal visibility over your attack surface to address threats in a prioritized, business-centric way.

It gives you a comprehensive view of the threats facing your digital infrastructure so you can see which demands the most urgent action.

Exposure Management vs. Patch Management

The difference between exposure management and patch management (i.e. vulnerability management) can be explained in the following way:

• Patch management gives teams a list of things to fix—say 500 or so vulnerabilities over the past five years that are just sitting on the backlog.
• Exposure management lets you see your entire attack surface, and which exposed assets present the biggest risk to the business. Then, you can make smart business decisions about where to place your security efforts.

While most teams understand that patching is necessary, not all understand when they’re ready to take the next strategic step.

Gartner On Exposure Management

In a recent paper, Gartner discussed how to mature from a vulnerability management program to an exposure management program.

They note that many SOC managers focus too much on finding issues and not enough on the impact those issues will have on the business. 

Gartner states that current efforts to curb the growing attack surface are falling behind, and that organizations need to make reducing the exposure of public-facing assets a priority.

Things like asset value and impact of compromise need to be factored into the equation when determining the best course of action—not just CVEs and CVSS scores. 

Back to our analogy. While repairing something repeatedly might strengthen it in some places, it will weaken it in others and ultimately contribute to overlaps that don’t serve a purpose.

It is a waste of time and an absence of strategy, much like having too many soldiers and not enough generals. 

It’s time for companies to guide their security resources with the big picture in mind.

Revealing the Limits of Patching Alone

The trouble with putting wholehearted faith in patch management programs is that they give a false sense of security. Teams think that as long as they’re patched, they’re safe.

A lot of effort goes into cutting down the backlog, and as those wins are reported to management, management feels safe, too.

But what happens when a compromised credential leads to an attacker breaching the network, elevating permissions (which were excessively allocated), and exfiltrating a customer database with health-sensitive information? Where was the vulnerability that could have been patched to prevent all that? 

The push is not to forsake vulnerability management or regular patching, but to draw attention to the fact that that is nowhere near enough for any enterprise to feel secure in their cybersecurity approach. 

The attack surface extends to endpoints, APIs, the dark web, social media, and beyond. Companies cannot afford a siloed vision or a limited approach, which is why they need to start looking at broadening their horizons where network-wide visibility is concerned. 

How to Transition from Patch Management to Exposure Management

The transition from patch management to a more cyber-mature EM involves several key steps. 

Unified Vulnerability Management (UVM) has been defined as the essential first step toward effective exposure management. Defined by Forrester as “a solution that serves as the primary book of record for all organizational vulnerabilities and improves and facilitates remediation workflows,” UVM provides an all-in-one approach to finding, prioritizing, and remediating vulnerabilities across all endpoints, servers, and cloud environments.

Risk-Based Vulnerability Management (RBVM) goes a step further, prioritizing risk not only based on the severity of the score, but on the total impact on the business. It takes into account how business-critical the asset is, the likelihood it will actually be attacked, and any external threat data that could tip the scales.

Exposure Management encompasses all of the above but expands its range across the entire attack surface, transcending vulnerabilities alone. It includes the effect that misconfigurations, excessive permissions, compromised credentials, and more will have in the final analysis. Then, it bases its security recommendations on the overall dangers to the business, from wherever on the attack surface they may arise. 

The Cost Efficiency of Exposure Management

“Cyber maturity” and “cost efficiency” don’t always coincide. But in this case, exposure management is one of the most cost-conscious things a company can invest in. 

Companies can spend money running regular vulnerability scans and chasing after fixes. They can throw their security resources at tackling the 500 or so CVEs that have been sitting on their to-do list for the past five years and gain some nominal benefits in the process. But the main risks they are exposed to may still be out there. 

Or they can transition to an exposure management approach in which each finding counts. No more wasting security spend and SOC cycles on patching things that may not make a big difference in overall security.

With an EM strategy, organizations can know that the moves they make directly reduce the attack surface, and in the most important ways.  

Conclusion

Think of exposure management as more than a shield (patched or not). It’s the whole suit of armor, and it maintains the shield, sword, helmet, and more in top working order—telling you which is most likely to get hit next, and how to prepare for that blow. 

As teams trade tactical defense for strategic security, they will do more than increase their cyber maturity. They will create a cyber posture in which every effort is optimized for maximum security effect.

Author bio: 

An ardent believer in personal data privacy and the technology behind it, Katrina Thompson is a freelance writer leaning into encryption, data privacy legislation, and the intersection of information technology and human rights. She has written for Bora, Venafi, Tripwire, and many other sites