Exposure is inevitable, but it’s not always bad. What may appear to be an undesired exposure may simply be a necessary part of a service architecture and service delivery. The VIAVI Observer Sentry approach to Threat Exposure Management (TEM) seamlessly combines the power of agentless technology, operationalized diagrams, and advanced automation to analyze and quantify your threat exposure and keep you two steps ahead of attackers. TEM insights also allow you to identify and mitigate the unintended exposure paths or overly permissive settings that can put assets at risk, or validate that things are configured properly and secured as designed.

Attackers think in graphs, not lists. Think like your adversary. The Threat Exposure Management approach taken by VIAVI changes how you view your environment, taking you from lists, configuration details, and logs to a visualization of your AWS environment from the attacker’s perspective. Observer Sentry identifies connections and interdependencies that linear protection strategies can miss, allowing you to visualize the relationships between assets and prioritize the most critical risks.

The Need for Exposure Management is on the Rise

“Through 2026, more than 60% of threat detection, investigation, and response (TDIR) capabilities will leverage exposure management data to validate and prioritize threats, up from less than 5% today” – Gartner Predicts 2023: Enterprises Must Expand from Threat to Exposure Management

The list of available threat detection tools and approaches grows longer each year, making it hard to decipher which ones bring the most value and how they interrelate. The volume of security incidents and notifications being generated is overwhelming. Applying Continuous Threat Exposure Management is critically important and helps address multiple challenges and needs.

• Reducing Attack Surfaces. Attack surfaces are the sum of all attack vectors that cybercriminals use to gain unauthorized access. Much like a physical attacker searching for weaknesses in infrastructure or surveillance practices, cybercriminals seek to identify the weak points in attack surfaces to establish new attack paths. TEM continually shrinks the attack surface by systematically identifying and analyzing potential attack paths giving you the visibility you need to prioritize and remediate the risks.
• Vulnerability Management enhances endpoint protection by scanning individual devices or machines for weaknesses that might allow them to be exploited or breached. Unpatched operating systems and applications commonly contribute to identified vulnerabilities but the challenges around remediating the vulnerabilities are significant. In fact, in The State of Vulnerability Management in DevSecOps report by the Ponemon Institute, 66% of respondents indicate their backlog consists of more than 100,000 vulnerabilities. Many factors contribute to this challenge but lack of exposure context and the need for enhanced prioritization strategies both play a significant role.
• Overly permissive settings grant unnecessary or unsafe access to systems, networks, or applications. These permissive access policies stand in stark contrast to emerging zero-trust that only grants access to services or ports when necessary.

Threat Exposure Management allows you to mitigate the dangerous combination of exposure, vulnerabilities, and permissive settings that create a clear path of least resistance for attackers. The holistic TEM approach uses continuous, automated analysis to proactively identify these potential exposures and threats while providing more visibility and protection than platforms focusing on vulnerabilities alone.

“Threat exposure management…expands beyond patches and automated blocking to better prepare against unpredictable threats and strategically reduce the enterprise’s attack surface” – Gartner Predicts 2023: Enterprises Must Expand from Threat to Exposure Management

Threat Exposure Management Pain Points

TEM addresses many of the common security pain points customers encounter as they strive to keep up with ever-changing cloud environments and service architectures:

• Visibility Gaps: Ongoing human, system, and design changes make a passive approach to visibility unsustainable. Locking down systems reactively does not fully account for the interactions and permissive settings that may be creating new attack vectors.
• Siloed Views: The elimination of siloed views is one key to optimizing visibility. With customers maintaining multiple AWS accounts, monitoring each individually is neither efficient nor adequate. Observer Sentry’s approach to Threat Exposure Management allows you to view all accounts and the interrelationships between them simultaneously.
• Automated Changes: Automation has heightened the pace of change in the end-to-end AWS environment faster than human abilities can comprehend. TEM platforms incorporate their own advanced automation and agentless technology to counter this speed with actionable context.
• Data Volume: Critical insights and vulnerabilities can be obscured by the sheer volume of data, potentially leading to extensive delays in detecting and mitigating issues. The pace of data flow also makes it challenging to isolate anomalies without the benefit of intelligent algorithms.