Most of us are familiar with the concept of vulnerability management. But in recent years we've heard newer terms like cyber exposure,
continuous threat exposure management (CTEM) and the more-encompassing exposure management.
What exactly is
exposure management, and how is it different from CTEM? Broadly speaking, exposure management is an expansion of vulnerability management that covers other sorts of exploitable weaknesses, such as misconfigurations, compromised identities, excessive permissions, potential attack paths, shadow IT and forgotten assets.
"It goes beyond traditional vulnerability management by unifying business and risk contexts with threat intelligence to expose, prioritize and help you close vulnerabilities while reducing risk and shrinking your attack surface," explains a
Tenable guidance page.
While vulnerability management traditionally has been concerned with patching flaws after they've been found, exposure management is proactive as well as reactive, seeking to detect and prevent potential vulnerabilities, attack paths and other weaknesses from developing in the first place.
Exposure management and its sibling, CTEM, both also stress threat intelligence, asset discovery, risk assessment, weakness validation (i.e., if a discovered flaw can actually be exploited) and mitigation.
While exposure management is a mindset that enables an organization to think of all its systems as a whole rather than as separate, siloed entities, CTEM is a framework that lets organizations build a cyclical process to achieve effective exposure management.
One is not a subset of the other. CTEM and exposure management are complementary. CTEM workflows must be built within organizations, but there are exposure-management platforms that will help organizations begin, maintain and streamline the continuous CTEM process.
Why vulnerability management falls short
Vulnerability management has traditionally been limited to finding and fixing known software and architectural flaws, especially those that land on the widely used Common Vulnerabilities and Exposures (CVE), Common Vulnerability Scoring System (CVSS) and Common Weakness Enumeration (CWE) lists maintained by various U.S. government and nonprofit entities.
Such a list-and-fix system worked well 20 years ago, when endpoints, servers and other IT assets were connected by hardwired networks behind on-prem firewalls, and IT staffers controlled software deployment and maintenance.
But traditional vulnerability management is well past its sell-by date in today's era of cloud assets, SaaS and web applications, remote work, bring-your-own-device, IoT and OT devices, AI-powered malware campaigns, and ubiquitous wireless networking. All these have enormously magnified the potential attack surface, both internally and externally.
In cloud computing, misconfigurations are more of a threat than software flaws. When the network perimeter disappears and identity verification is the first line of defense, password compromise becomes a top attack vector. If SaaS applications can be used in unmanaged browsers and cloud instances spun up without IT approval, defenders are left in the dark.
All these developments have created
attack paths that vulnerability management cannot see. That's why the discovery, assessment, and mitigation of system weaknesses must reach beyond known software flaws.
How exposure management expands the parameters of vulnerability management
Exposure management and CTEM both begin with asset and weakness discovery and assessment. You can't defend what you're not aware of, and almost every organization is running unauthorized software, undocumented cloud assets, forgotten hardware and open network ports without the knowledge of its IT or security staff.
Attack surface management is a key part of this process, scanning and identifying potential weaknesses and entry points in all internet-facing assets. Internal inventory scans are also essential, as they map out both known and unknown assets and potential vectors of lateral movement once an attacker gains entry.
Cloud-focused security tools like cloud native app protection platforms (CNAPP) and cloud security posture management (CSPM) are essential to finding misconfigurations and application weaknesses in cloud instances, while web application scanning can spot real-time vulnerabilities in SaaS and web apps.
Identity security posture management (ISPM) similarly finds and diagnoses excessive permissions, misconfigurations, compromised passwords and weak verification processes in identity systems.
Exposure management "expands to cover your entire attack surface, including all digital assets and identities, and all forms of preventable risk like common vulnerabilities, misconfigurations and excessive permissions," says Tenable.
Once all assets, whether on-prem, in the cloud, authorized or not, have been catalogued, their communications and relationships mapped out, and their associated vulnerabilities and other weaknesses documented, then exposure management can assess risk by considering both the likelihood of exploitation for each weakness and the potential impact if the associated asset is compromised.
After that risk is quantified, then each weakness can be ranked in order of priority, giving security practitioners a place to start the mitigation process. That's despite the understanding that not all low-risk flaws can or should be patched.
"The goal of exposure management is not to try to remediate every issue identified nor the most zero-day threats, for example, but rather to identify and address the threats most likely to be exploited against the organization," reads the 2022 Gartner white paper that introduced the concept of continuous threat exposure management. (Tenable itself introduced exposure management in 2017 under the term "cyber exposure.")
This holistic view of an organization's entire system, looking forward as well as backward and covering all assets, greatly aids compliance with rules and regulations that mandate high levels of cybersecurity awareness and mitigation.
How exposure management differs from CTEM, and how the two support each other
As befits a process workflow that differs from one organization to another, CTEM often incorporates manual penetration testing or pen-testing-as-a-service (PTaaS) in the discovery and validation of potential vulnerabilities.
"While exposure management focuses on risk reduction and attack surface management, like comprehensive asset visibility, vulnerability prioritization and exposure remediation, Gartner developed CTEM as a framework to guide exposure management processes," explains Tenable. "Both can help you proactively find and fix critical business and cyber risks."
Exposure-management platforms, such as Tenable One, often take a more automated approach. For example, once network assets and their potential weaknesses are documented, the platform may use the MITRE ATT&CK or similar frameworks to map out potential attacker paths into and through the network, adding to the granularity of risk prioritization.
Such platforms can also greatly automate their core processes, with AI and machine learning taking care of routine detections and false-positive alerts. The vast amounts of time saved let short-staffed SOC teams focus on higher-priority issues.
Exposure-management platforms also unify cloud, on-prem, OT, IoT and other tools into single interfaces, plugging the gaps that exist between separate tools and letting SOC teams gain clarity and visibility into their entire systems. Meanwhile, custom-built CTEM processes often must link together disparate tools with limited intercommunications.
Again, the two are not exclusive. Exposure management is a mentality, and CTEM is a framework that enables efficient exposure management. Unified exposure-management platforms like Tenable One greatly aid and streamline both efforts.
"Think of CTEM," the Tenable explainer page says, "as the foundation for your comprehensive exposure management program."
