Exposure management: Key to navigating the cybersecurity skills gap

With cyber threats on the rise, organizations across industries are scrambling to fortify their defenses and safeguard sensitive data. However, a significant obstacle stands in the way: the widening skills gap in cybersecurity.

According to ISC2's latest Cybersecurity Workforce Study, the worldwide cybersecurity workforce shortage has reached a new high, nearing 4 million, despite a 10 percent growth in the workforce over the past year. The gap between supply and demand has surged by 12.6 percent annually, driven by factors like economic uncertainties, AI, and a complex threat landscape. 

In short, cyber threats are becoming increasingly sophisticated while the demand for skilled cybersecurity professionals continues to outpace the available talent pool. This discrepancy not only highlights imminent security challenges, but should serve as a wake-up call for organizations to make radical changes to their approach to cybersecurity.

Attack surfaces are a moving target

Businesses today face a number of critical security challenges:

● Attack surface can vary by approximately 9 percent every month, according to our research team here at CyCognito.

● The frequency and cost of vulnerabilities is on the rise, with the average cost of a breach reaching $4.45 million.

● On average, enterprises today identify 345 new 'critical' threats each month.

● Proliferation of cloud assets, APIs, AI apps and third-party applications.

External attack surfaces can be vast and complex. A single organization can have thousands of systems, applications, cloud instances, IoT devices and data 

exposed to the Internet -- often sprawling across subsidiaries, multiple clouds, and assets managed by third parties. 

Given the size and complexity of modern organizations, identifying hidden and unmanaged assets, which are implicated in over 50 percent of breaches, is incredibly difficult.

As cybersecurity gains more attention at the board level, underscored by escalating governance and reporting mandates, the focus on teams intensifies significantly. This reflects the growing recognition of cybersecurity's critical role in safeguarding organizational integrity and ensuring regulatory compliance, placing unprecedented demands on teams tasked with these essential protections.

Finding the most critical vulnerabilities continues to be harder

Threats emerge from many sources. Hackers constantly evolve their techniques in the search of the path of least resistance. Security teams, already stretched thin, are tasked with discovering and understanding each of their organization's assets. They are inundated with thousands of alerts and are making educated guesses as to which are 'high priority.' 

But how exactly can they efficiently distinguish between a false positive, true positive and false negative if they have limited visibility into their assets? This is the crux of the problem.

The result: many threats remain undetected, making timely remediation an impossibility. 

Meanwhile, the asymmetric nature of the attacker/defender relationship means that the defenders need to be right all of the time and all the attacker needs is a single security gap to exploit 

The Panacea: Exposure Management

Significant problems often require an overhaul of current processes. Exposure Management, for example, has been growing in popularity among CISOs in the last few years as a way to improve an organization's security despite a restricted talent pool.

A core pillar of Exposure Management is visibility. As noted by Gartner, maintaining a continuously updated inventory of an organization's attack surface is imperative. This includes paying attention to even the smallest changes in the digital ecosystem, which could inadvertently weaken an organization's security posture and data protection efforts. This level of visibility is particularly critical in a landscape where skilled resources are scarce, and the ability to manually monitor and analyze every potential risk is beyond the capacity of most security teams.

Exposure Management also emphasizes the concept of prioritization. In other words, a deep understanding of the context in which each exposed asset operates. This includes evaluating the function of the asset and the value of the data it handles. It is automation that emerges here as a key enabler of contextualization, given its labor-intensive nature. This negates the need for organizations to rely on additional headcount. 

To break it down tactically, Exposure Management can help security teams more effectively: 

● Establish an automated, consistent, repeatable process for discovering new and existing assets across the organization.

● Evaluate the business significance of these assets and assign them to the appropriate steward within the organization, ensuring accountability.

● Assess all assets regularly for potential attack vectors to understand associated risks better.

● Prioritize risks based on the significance of the asset, its susceptibility to exploitation, and the likelihood of an attack, leveraging intelligence on known threat actors.

● Facilitate efficient remediation of identified threats, reducing an organization's overall risk.

It won't happen overnight, but you have to start somewhere

Exposure Management offers a strategic framework for reducing security risks, especially in the face of a skills shortage. Automating the discovery of assets, evaluating their significance, and prioritizing threats based on contextual intelligence are indispensable capabilities to protect your perimeter.

But change doesn't happen overnight. Making the leap requires a shift in mindset and resources. It will require looking at the tech stack and making changes; it will require a shift in personnel to ensure everyone has the support they need; it will require full alignment with the board to ensure budgets don't impact the team's ability to do their jobs. 

It's not as easy as flipping a switch, but once you reach critical mass, the benefits will far outweigh the efforts.

Image Credit: Dizain777/Dreamstime.com

Graham Rance is VP Global Pre-Sales at CyCognito