Modern Security Testing  – Leveling up the Crash Test Dummy – Source: securityboulevard.com

One thing not often thought of is the lowly crash test dummy. Traditionally, crash test dummies were modeled after male bodies leading to vehicle safety standards and designs being disproportionately geared towards protecting male passengers. As a result, studies found that women and children suffered more significant injuries more frequently in car crashes.

Similarly, our security standards and programs have struggled to keep pace with the threats of today leading to bias in what gets protected and how. Traditional security testing and assessment methods are not enough for modern stakeholders who require real-time assurance that data and business processes are protected from evolving threats. In today’s threatscape, breaches are not a matter of “if”, but “when”.

Many compliance requirements mandate annual, biannual, or quarterly penetration tests. These penetration tests often focus on standard attack scenarios. Other common compliance requirements include independent audits, assurance assessments, and risk-based corrective action plans. The problem is these assessments struggle to keep pace with how quickly attacks and your own environment change.

Forward-thinking organizations have turned to regular tabletop exercises to test their Incident Response and crisis response readiness. These exercises build muscle memory for your teams so that they know who to contact and what to do during common breach scenarios. Regularly practicing these scenarios helps everyone stay calm during a real event – and we all know calm minds make better decisions.

Having a Continuous Threat Exposure Management (CTEM) program is another way to address these limitations. A CTEM program should be directed to find and fix whatever most threatens your business. There are technologies you could leverage in this program to provide ongoing, data-driven validation of an organization’s security posture. This is crucial to have an attacker’s viewpoint of the organization’s changing environment. Using this approach allows organizations to proactively address gaps before a malicious actor exploits them.

CTEM, Breach Attack Simulation (BAS) and Security Validation tools typically include a few common components:

Assessment Scope

Scoping hybrid, cloud, and multi-cloud environments presents a challenge for traditional testing methods. Additionally, a penetration test may only touch on a quarter of MITRE tactics/techniques during a test. Newer tools dynamically adjust the scope based on systems they can see, testing across the frameworks (MITRE, Kill Chain, etc.) for a more holistic evaluation.

Automation

Another similarity is they have some level of automation. This reduces the need for human intervention and frees up your team to focus on critical issues. An added benefit is the ease of retesting once remediations have been completed. Automated attack methods ensure consistency in retesting and save time.

Assess your Security Controls

Organizations deploy numerous security controls as part of their defense-in-depth strategy. Utilizing a validation tool will allow you to verify that controls are functioning as intended. You can proactively fix discovered misconfigurations and enhance detections to account for gaps. Retesting after improvements will provide data demonstrating risk reduction.

Actionable Mitigation

Teams often struggle to provide meaningful remediation guidance following an assessment. It is crucial to understand the contextual risk of each finding to prioritize remediation. Low-risk vulnerabilities are often the last to get addressed, but what if that low vulnerability was the first exploit on the attack path that allowed for the attacker to compromise a database containing sensitive data? Such vulnerabilities should be scored as a higher risk based on the impact. The data gathered from regular testing helps determine which risks are most critical.

Test Emerging Threats

New attacks should be regularly tested in your environment to evaluate your organization’s controls against modern techniques. An example use case here is running a zero-day test to assess its impact in your environment. You can then provide your patching team with a list of servers where exploitation of that zero-day lead to the greatest impacts. This prioritization will ensure you respond more effectively and efficiently to zero-day vulnerabilities. Your blue team will also gain valuable context for that threat in your environment to quickly craft detections and mitigations.

Continuously identifying threats while refining your response and remediation will move your program beyond antiquated assessment requirements.

If you are ready to elevate your security program from an outdated “crash test dummy” approach and address current threats with modern methods contact us at [email protected]