The average organization has dozens, perhaps hundreds, of cybersecurity point solutions, often provided by nearly as many vendors. Typically, a business will take on a new solution when it perceives a new threat, patching what seems to be a hole in its defenses.
It's natural to add new security tools, especially in response to urgent matters. But over the long run, this ad hoc, reactive approach creates tool sprawl, wherein various security tools are monitored and maintained by personnel operating in different siloes.
For more information:Some tools overlap in what they protect, creating conflicts of both data and responsibility. Others leave gaps between coverage areas that attackers might discover and exploit.
"Even if you have strong security policies in place, it's easy to overlook certain weaknesses in your environment, such as open ports or a lack of multi-factor authentication (MFA)," says
Nathan Dyer, Senior Director of Product Marketing at Tenable, in a recent blog post. "When combined, these factors form toxic combinations that can make it easier for an attacker to move laterally."
The antidote to tool sprawl is to reduce your number of vendors and opt instead for bundles that include different tools. Ultimately, you want to adopt unified platforms that consolidate nearly all your cybersecurity needs, and which present their findings and recommendations in easy-to-monitor single dashboards.
"Organizations that continue to operate with siloed visibility will struggle to keep up with building threats," says Dyer. "The ability to unify data across multiple siloed security tools is no longer a nice-to-have; it is a requirement for understanding and addressing risk in an interconnected world."
How siloes lead to security weakness
Using many different tools means managing relationships and contracts with dozens of vendors, cost inefficiencies, incessant alerts, and few days when a point solution doesn't need to be updated.
This surfeit of security solutions also means having to train your security staff many different ways, making them look at many monitoring screens, and forcing them to adapt to many different metrics and reporting schemes.
That carries risk, because staffers trained on too many tools are more prone to make mistakes, especially when tools use different criteria to present data and determine priorities.
For example, one solution might assess vulnerabilities and threats as "low risk" or "high risk"; another might toss in "medium risk"; yet another tool might create a fourth category of "critical risk." How are security teams meant to mix and match among these different standards?
It gets worse when teams in the same organization use competing tools and standards. In such cases, even if these siloed teams want to talk to each other, they might have difficulty communicating what they mean. Their prioritization criteria might not match up; their data presentations might use completely different metrics.
This confusion just creates more opportunities for attackers, who can spot and exploit the gaps in coverage left by narrowly focused teams.
"The bad guys don't care about your security siloes," Dyer points out. "They search for your weakest links and move laterally across platforms and identities, looking to exploit issues without regard for those artificial barriers."
How consolidated platforms fill the gaps
"What if all siloes streamed data into a centralized repository where you could analyze it all contextually and create unified workflows to streamline remediation?" asks Dyer in
another blog post. "Better yet, what if you could use this contextualized data to get a complete view of the riskiest areas of your attack surface and quickly show your executives where the organization is most exposed?"
Over the past few years, the cybersecurity industry has been moving toward bundles and unified solutions that handle many aspects of cybersecurity, from network security to vulnerability management to endpoint detection and response and cloud security.
Most notably, a Gartner survey from 2022 found that 75% of responding organizations wanted to reduce their number of vendors.
Often, cost savings and ease of oversight are cited as arguments for consolidated platforms, but just as important are the gains to be had in coverage and protection.
A unified platform offers greater coverage and more comprehensive reporting, as well as better integration, orchestration, compatibility and communication among its tools. That leads to quicker response processes, especially when using automated platforms that can take the first steps toward mitigation of a threat or vulnerability.
Fewer tools also means fewer patches to install and a smaller chance of misconfigurations, with the greatest gains often to be found in cloud-based unified platforms, which can scale, update and adapt more easily than on-prem systems.
For security staffers, a single pane of glass is preferable to having dozens of different screens to monitor, and different metrics and categories to understand. Alerts will be reduced, and retraining far less frequent, leaving SOC teams with more time to tackle important issues.
Unification through exposure management
Several cybersecurity companies, among them Tenable, have consolidated their security offerings into exposure-management platforms. These expand the concept of vulnerability management to match the expanded attack surface, including cloud misconfigurations, excessive user permissions, shadow IT and AI usage, compromised identities and forgotten or outdated assets.
Exposure management adopts some of the precepts of risk-based vulnerability management by actively seeking out and fixing vulnerabilities and other weaknesses that pose high risks, while recognizing that not all low-risk or low-impact issues need to be mitigated.
It takes that risk assessment a step further by mapping out potential attack paths to prioritize mitigations, as well as validating vulnerabilities to determine whether they truly can be exploited. Internal, public-facing and cloud assets are scanned, catalogued and assessed for risk, and mitigations are considered in the context of business goals.
Overall, implementing exposure management or its complementary sibling continuous threat exposure management (CTEM) involves adopting a new security mindset in which an organization thinks of all its digital systems as a comprehensive whole instead of separate, siloed assets.
"By breaking down data silos and adopting an exposure management mindset, security leaders can gain a more holistic view of their attack surface and true business risk," says
Robert Huber, Tenable's Chief Security Officer, in a blog post. "This enables better resource allocation, more defensible prioritization, clearer communication about security posture and, ultimately, a more effective preventative security program aligned with organizational objectives."
Please visit our exposure management topic page.
