2023 彙整 - Page 115 of 127

Get to full asset inventory by combining active scanning with API integrations – Part 6

Imagine: there’s a new security threat. How do you find out if your organization is affected? You might research the CVE to gauge the severity and impact of the vulnerability. You might perform a vuln scan — if there’s a vuln check available. At some point, you’ll eventually end up with a list of devices that you need to update.

What are your next steps?

The cost of not tracking asset ownership

In an ideal world, your asset inventory would be the first place you would look for information. However, the reality is: most organizations have their asset inventory data distributed across multiple solutions and maintained by different teams. So instead of being able to focus on mitigating issues, your security team spends an inordinate amount of time doing detective work. And for security practitioners, time is of the essence.

Asset inventory is the first step to getting context around a device: the hardware, OS, software, etc. But what about who owns it? More and more, knowing who is responsible for an asset is as important as knowing what an asset is. Without clear asset ownership tracking, you waste a lot of time going from team to team, person to person, trying to find out who is responsible for an asset.

Let’s take a look at three reasons why a lack of asset ownership can adversely impact your business.

Reason #1: Forgotten assets can be costly

One of the biggest obstacles to tracking asset ownership is humans. Humans are dynamic, often upgrading to new equipment, changing roles, or even leaving organizations entirely. As a result, assets are often left abandoned, unmanaged, and unowned. Documenting asset ownership manually, like in a spreadsheet, means that the data becomes outdated very quickly. Effective asset ownership tracking requires regular updates and attention. Without a major investment of time and resources to maintain asset ownership tracking, stale data will continue to plague your organization. For example, consider infrastructure that no longer has an owner, but is still racking up recurring expenses. These forgotten assets can be costly over time.

Reason #2: Lack of asset ownership can lead to service outages

Your business relies on having systems that are working efficiently. Systems need to be updated, upgraded, and maintained regularly to ensure that everything runs smoothly and outages do not occur. However, what would happen if a specific system needed a configuration update to continue to operate? How would you know who to go to?

Oftentimes, it’s a goose chase. You start with one person (or team) and hope they can point you in the right direction. While you’re chasing down the appropriate person to help you, access to the systems you need may be shuttered or months may have passed by. These consequences can be detrimental to business – especially if these systems directly impact revenue.

Reason #3: Wasted time slows down remediation

9 years ago: Shellshock.

5 years ago: Apache Struts.

1 year ago: Log4Shell.

Nearly a decade has come and gone between these major vulnerabilities, and yet, building comprehensive asset inventory and tracking asset ownership continues to be a challenge. One of the biggest challenges faced by security teams is that they often need to rely on asset owners to take action to update and secure their devices. However, tracking down the right asset owner can be a bit of a journey through a myriad of data sources – from CMDBs to VMs to EDRs to device logs to spreadsheets. The amount of time that security teams spend hunting for information is a hindrance to fast response and remediation times.

Tracking asset ownership with runZero

runZero 3.5 introduces the ability to track asset owners in your inventory. Asset owners can be anyone in your organization who can help you remediate issues. For most organizations, assets will likely have multiple owners, such as an individual, team, and business unit. For example, a laptop might have an assigned device user, business owner, IT owner, and security owner. Each of these assignments will help you zero in on the right person who can take action on the device, based on the situation. Let’s take a look at how runZero can help you track different types of owners within your organization.

What are ownership types?

In runZero, ownership types help you classify and assign ownership to assets. There is a default ownership type, called Asset Owner, which automatically pulls owner data from integrations you have configured. Otherwise, you can add up to nine custom ownership types based on what your organization needs. For example, you might want to have ownership types for the security owner, IT owner, and business owner.

When you create an ownership type, you will need to specify the following:

Name – The name of the asset ownership type, such as IT owner.
Reference – You can set the reference to user, group, or none. If set, you will be able to easily search within the user or group inventories for owners that match the display name.
Visibility – You can set the visibility to hidden or visible. This setting controls the ability to view the asset owner from the asset inventory and asset details page.

After you have created your ownership types, you’re ready to start assigning owners within your asset inventory. Let’s take a look at how you can do this in runZero.

How to assign ownership to assets in runZero

There are a couple of ways to assign asset owners: manually or automatically through rules and the API. However, the most efficient way to apply ownership is through rules, which allows you to set up specific conditions and automate the assignment of asset ownership after each scan. For example, let’s say you want to assign an IT owner for all firewalls. Here’s how you can do it with rules:

From the Rules page, create a rule using the asset-query-results event type. Based on this event type, the query will run against the asset inventory after a scan completes.
Give the rule a descriptive name, like Automate IT ownership for firewalls.
Configure the rule with the following conditions:
- Run the following query after a scan completes: type:firewall and the number of matches is greater than 0.
- If there is a match on the query, take the following action: modify the asset and set the ownership of the matching assets. This value for the owner can be any name. For our example, we will assign the IT owner to someone on the team named Tim.
- Make sure the rule is enabled. If it is not, it will not run.
Save the rule.

Each time a scan completes, this rule will check for matching conditions and perform the configured actions.

Viewing ownership data for an asset

Now that you’ve set up ownership types and automated ownership assignment, let’s take a look at how you can view this data in runZero. You can view ownership information from two areas of the console: the asset inventory and the asset details page.

There’s a new column in the asset inventory called Owners, which will list the owners for the asset. If there are multiple owners, there will be a plus (+) sign to indicate that there are more for you to view. The owner name that gets displayed in the inventory table depends on the order you have them ranked on the ownership types page. The highest ranked ownership type will take precedence. In our example, we have our IT owner ranked first, so we will see our IT owners displayed in the inventory table. Other owners will be viewable by hovering over the plus (+) sign. From the asset inventory page, you can select some assets then use the Manage asset ownership button to manually update the owner for those devices.

From the asset details page, there is a new ownership section that lists all the visible owners assigned to that asset. If the ownership type has a reference set (to user or group), you’ll be able to click on the magnifying glass next to the owner name to search within those inventories for matching results. From the asset details page, you can go to Manage > Asset ownership to manually update the owner for that specific device.

Searching the inventory for assets based on owners

Now that you have asset ownership data in your inventory, you can search for assets that match specific ownership criteria. To enable searching based on ownership attributes, the following new keyword terms have been added:

owner – Filter by asset owner name, such as Tim.
has_owner – Filter assets by whether or not they have an owner. Use t or f as your input.
owner_count – Use a comparison operator (>, >=, <, <=, =)to filter assets by count.
ownership_type – Filter by ownership type, such as IT owner.

Here are a few useful queries (based on some common use cases):

has_owner:f – Searches for assets that don’t have an owner assigned.
ownership_type:"IT owner" – Searches for assets by ownership type.
owner_count:>1 – Searches for assets that have more than one owner.

For example, if you need to gauge the number of unowned (and likely unmanaged) assets in your inventory, the query has_owner:f would help identify assets that don’t have an owner. Inversely, you can use has_owner:t to see all the ones that do have an owner. Between these two results, you can discern how well you’ve got your asset ownership data covered. To see how well your organization is tracking asset owners, you can also check out the asset ownership goal from the dashboard.

Zero in on unowned assets on your network

Imagine: there’s a new security threat. Thankfully, you have an asset inventory that includes asset ownership data. With a solid program and solution in place to track asset owners, you’ve eliminated unnecessary time spent chasing down people. You can focus on remediation.

If you’re a runZero Enterprise customer, you can check out the ownership capabilities by going to the new Ownership page in your console. You’ll notice a new menu item for it under Global Settings. Otherwise, if you’re new to runZero, sign up for a free trial to test out this new feature for 21 days.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.

runZero 2023

Linux vDeployer Is Now GA

For more information on preparations and execution, please refer to https://customer-portal.vicarius.io/how-can-i-deploy-the-agent-remotely

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2023

How Does Passwordless Authentication Fit With Zero Trust Security Models?

Will 2023 be the year we finally eliminate passwords? For the last decade, cybersecurity experts have both been pushing for and predicting that a passwordless future is just around the corner. However, while passwords have been declining in recent years in favor of more robust forms of authentication, an entirely passwordless future has yet to materialize.

But that all could be set to change with the increased adoption of zero trust security models. Zero trust does away with implicit trust and requires all users and devices, whether inside or outside the corporate network, to be continuously authenticated and authorized. And critically, zero trust is also starting to mean zero passwords. But why?

Let’s dive into why passwordless authentication is important and how it fits into zero trust security models.

What is Passwordless Authentication?

As the term suggests, passwordless authentication is a way of verifying a user’s identity with something other than a password. Common types of passwordless authentication include email-based or SMS-based one-time codes, multi-factor authentication, and biometrics.

Biometrics are increasingly favored over other types of passwordless authentication because they’re virtually impossible for hackers to imitate, and they reduce user friction. Some examples of biometric authentication include retinal scans, voiceprints, facial recognition, fingerprint scans, and biometric mouse movements.

As the term suggests, passwordless authentication is a way of verifying a user’s identity with something other than a password. Common types of passwordless authentication include email-based or SMS-based one-time codes, multi-factor authentication, and biometrics.

Biometrics are increasingly favored over other types of passwordless authentication because they’re virtually impossible for hackers to imitate, and they reduce user friction. Some examples of biometric authentication include retinal scans, voiceprints, facial recognition, fingerprint scans, and biometric mouse movements.

Why Use Passwordless Authentication?

Here’s what it comes down to; passwordless authentication is simply more secure than password-based authentication.

While businesses have relied on passwords for decades, they’re no longer considered a secure way to protect our accounts and corporate networks. For example, 44% of employees reuse passwords across personal and work-related accounts. Moreover, most passwords are extremely easy to guess – the top five passwords globally are “123456”, “Password,” “12345678”, “qwerty,” and “123456789”.

As a result, hackers have long favored password attacks to breach corporate networks or personal accounts. Many different password attack methods exist, but the most common are:

Brute-force attacks: This hacking method uses trial and error to crack passwords, typically using lists of common passwords or leaked passwords obtained from the dark web.
Surgical attacks: These are a type of targeted attack where the hacker researches the intended victim, scouring their public accounts to find key details like their birthday, favorite sports team, hobbies, names of their children, etc., that the user may use in passwords.
Phishing/Social engineering: Here, cybercriminals pose as a trusted entity like a well-known company or another employee and trick the target into sharing their login details via a fraudulent login screen. Other methods include sending emails with a malicious link that automatically installs key-logging malware on the victim’s computer.

But by opting for passwordless authentication, you can eliminate or vastly reduce the risk of falling victim to these types of attacks.

There are also other reasons to move away from passwords. For example, passwordless authentication is more convenient for workers because it leverages something the user has or something inherent to them, eliminating the need for them to remember anything. This also means employees can log into devices faster.

Rising Zero Trust Adoption

72% of organizations are in the process of adopting zero trust or have already implemented it. Moreover, an eye-watering 90% of organizations say that advancing zero trust is one of their top three IT and security priorities. But why exactly is zero trust becoming so widespread?

Adopting a zero trust approach can the cost of a data breach by approximately $1.76 million and offer boosted efficiencies that amount to savings of 40 manhours per week. Moreover, companies that leverage zero trust network segmentation (an element of ZTNA) are two times more likely to avoid critical outages due to security incidents.

Undoubtedly, the need for continuous authentication is rising as remote working, and distributed workforces become more common. Zero Trust Network Access (ZTNA) is a critical set of technologies and functionalities here, enabling remote users to access internal applications securely. ZTNA is fast becoming essential for businesses in the modern world.

Can You Have Password-Based Zero Trust?

Yes, and many organizations do. However, cybersecurity experts are now warning that password-based zero trust does not meet the defense demands of the increasingly severe cyber threatscape of today.

Why Passwordless Zero Trust Is the Way Forward

Here’s the bottom line. Passwords are not only weak forms of security, but they also make your zero trust program slower, more expensive, and less effective.

Passwords require more tools, which drives up costs. Additional tools demand more administrators, new user licenses, and often more training for users and the help desk. All of these factors result in a more expensive security program.

Additionally companies that use passwords in conjunction with MFA often still have security gaps. This is typically because legacy systems or otherwise awkward technologies don’t play well with some MFA tools, leaving specific corporate systems protected only by passwords. There can also be MFA gaps in workstation login, VPNs, RDPs, and VDIs or IoT devices where passwords are the default.

Lastly, there are resource constraints involved with managing robust password-based security. IT and security teams are often understaffed and overwhelmed, and the current cybersecurity skills gap exacerbates this problem. Moreover, rising economic uncertainty puts more pressure on businesses of all sizes to reduce their IT budgets and take cost-cutting measures.

In this increasingly severe climate, security teams are feeling the pains of passwords more than ever before. By taking passwords out of the equation, organizations can reduce the labor burden on already over-stretched security workers and give them more time to spend on proactive cybersecurity measures.

Final Thoughts

Credential stuffing may be one of the oldest attack methods, but it’s still going strong today. For example, credential stuffing attacks became so prevalent in the first quarter of 2022 that attack traffic surpassed legitimate login traffic in some countries. And equally concerning, the first half of 2022 saw more attacks against MFA than any previous year.

Simply put, cybercriminals are increasingly targeting our traditional defense measures, namely passwords and MFA. As a result, companies embarking on their zero trust journey need to move away from passwords and weaker forms of MFA in favor of more robust passwordless authentication.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Network Portnox 2023

ESET Threat Report T3 2022: When war meets cyberspace – the impact of Russia’s invasion on digital threats

Since the start of the Russian invasion of Ukraine, ransomware has increased its destructive capabilities; in T3, several ransomware-mimicking wipers appeared in connection with the war, targeting Ukrainian entities.

RDP password-guessing attacks remained down in T3 2022, with daily averages oscillating around 100 million attack attempts (compared to 1 billion in T1 2022).

Despite patches having been available since December 2021, exploitation attempts of Log4j grew by 9% in T3 2022.

Cryptocurrency threats declined by 25% in T3 2022, with detections almost cut in half in a year-on-year comparison; while crimeware is decreasing, cryptocurrency-related scams are rising.

Banking malware detections more than doubled in a year-on-year comparison.

Android detections grew by 57% in T3 2022, with Adware, HiddenApps, and Spyware driving the increase.

Since the start of the Russian invasion of Ukraine, ransomware has increased its destructive capabilities; in T3, several ransomware-mimicking wipers appeared in connection with the war, targeting Ukrainian entities.

RDP password-guessing attacks remained down in T3 2022, with daily averages oscillating around 100 million attack attempts (compared to 1 billion in T1 2022).

Despite patches having been available since December 2021, exploitation attempts of Log4j grew by 9% in T3 2022.

Cryptocurrency threats declined by 25% in T3 2022, with detections almost cut in half in a year-on-year comparison; while crimeware is decreasing, cryptocurrency-related scams are rising.

Banking malware detections more than doubled in a year-on-year comparison.

Android detections grew by 57% in T3 2022, with Adware, HiddenApps, and Spyware driving the increase.

BRATISLAVA — February 8, 2023 — ESET released today its T3 2022 Threat Report, summarizing key statistics from ESET detection systems and highlighting notable examples of ESET’s cybersecurity research. The latest issue of the ESET Threat Report (covering October to December 2022) highlights the impact of the ongoing war on Ukraine and its effects on the world, including cyberspace. The invasion continues to have a major impact on energy prices, inflation, and cyberthreats, with the ransomware scene experiencing some of the biggest shifts.

“The ongoing war in Ukraine has created a divide among ransomware operators, with some supporting and others opposing the aggression. Attackers have also been using increasingly destructive tactics, such as deploying wipers that mimic ransomware and encrypt the victim’s data with no intention of providing a decryption key,” explains Roman Kováč, Chief Research Officer at ESET.

The war also affected brute-force attacks against exposed RDP services, but despite the decline of these attacks in 2022, password guessing remains the most favored network attack vector. The Log4j vulnerability, patches for which have been available since December 2021, still placed second in the external intrusion vector ranking.

The report also explains the impact of cryptocurrency exchange rates and soaring energy prices on various crypto-threats, with cryptocurrency-related scams experiencing a renaissance. ESET products blocked an increase of 62% in cryptocurrency-themed phishing websites in T3, and the FBI recently issued a warning about a surge in new crypto-investment schemes. Overall infostealer detections trended down in both T3 and the whole of 2022; however, banking malware was an exception, with detections doubling in a year-on-year comparison.

Other trends in T3 include increased phishing activity impersonating online shops during the holiday season and the rise in Android adware detections due to malicious versions of mobile games being placed on third-party app stores before Christmas. “The Android platform also saw an increase in spyware throughout the year, due to easy-to-access spyware kits available on various online forums and used by amateur attackers,” added Kováč.

The ESET T3 2022 Threat Report also reviews the most important findings and achievements by ESET researchers. They discovered a MirrorFace spearphishing campaign against high-profile Japanese political entities, and new ransomware named RansomBoggs that targets multiple organizations in Ukraine and has Sandworm’s fingerprints all over it. ESET researchers also discovered a campaign conducted by the infamous Lazarus group that targets its victims with spearphishing emails containing documents with fake job offers; one of the lures was sent to an aerospace company employee. As for supply-chain attacks, ESET experts found a new wiper and its execution tool, which they have both attributed to the Agrius APT group, aiming at users of an Israeli software suite used in the diamond industry.

Besides these findings, the report also summarizes the many talks given by ESET researchers in recent months and introduces talks planned for both the RSA Conference and Botconf.

For more information, check out the ESET Threat Report T3 2022 on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2023

Understanding the Ins & Outs of Cyber Risk Quantification

Introduction

In today’s digital world, cyber risk is high and growing. The best way to control this risk is with a proactive cyber security strategy that quantifies and measures your company’s vulnerability to theft, fraud, or data breach.

The cyber threat landscape is diverse, and there is a wide range of potential threats in this sector, such as intellectual property theft, ransomware, data breaches, DDoS attacks, and insider threats. As cyber criminals improve on new methods for making threats, it is therefore important for cyber security professionals to be on top of where the latest threats are to hide from evolving threats. But for a company to achieve this, it must first understand the risks of cybersecurity, be vigilant in its security stance, and be aware of its accompanying risks.

Cyber risk quantification (CRQ) is the primary route to understanding the cyber threat landscape and mitigating risks within a cyber security environment. Cyber risk quantification is also part of Cyber Security Risk Management and is a crucial part of an organization’s overall security posture. It involves assessing risks relating to various cybersecurity topics, such as vulnerabilities, threats and impacts. Quantification addresses measurement, tracking and reporting on the risks relating to specific topics to prepare for cyberattacks effectively.

Risk quantification is determining how likely a threat or attack is to be successful against your organization and then assessing the severity of such an event. Cyber risk quantification is a part of this process, and it pertains specifically to threats that target information on computer networks or in physical systems, like computer networks or smartphones. These include both internal threats (such as employees) and those from external sources (hackers).

Risk quantification is an enterprise tool to help them understand their existing cyber risk environment. It also enables them to devise effective strategies for reducing those risks by implementing appropriate controls.

What is Cyber Risk Quantification?

This process of cyber risk quantification has been described as a three-step process: identifying the “pen-testing assets”, counting vulnerabilities, and measuring the potential threats. These steps represent a holistic approach, allowing a comprehensive view of one’s cyber risk posture and its vulnerabilities, threats, and risks.

At its core, cyber risk quantification is not a specific set of rules or methodologies but rather a method for conducting a rigorous, in-depth analysis of subjecting any IT infrastructure. The intent is to obtain objective evidence to develop strategies for reducing risks and ultimately strengthening an organization’s cyber resilience.

Benefits of Cyber Risk Quantification

Cyber risk quantification is important in ensuring that cyber threats are understood and can help cyber security teams analyse vulnerabilities and risks and create cyber risk mitigation strategies. The following are the benefits of cyber risk quantification.

Provides Insights into Vulnerabilities

An analysis of the information technology assets allows companies to understand their cyber risk posture and quantify their security vulnerabilities. The process makes companies feel more secure in knowing they are not as vulnerable as they originally assumed.

Helps Identify & Mitigate Threats

Cyber risk quantification is a process that helps identify the number of potential threats within an organization. It helps determine what the company needs to do to prevent a cyber attack.

Provides Information for Basing Decisions

The cyber risk quantification process allows the creation of an actionable and detailed plan for organizations to make informed decisions about protecting themselves from cyberattacks.

Helps Identify the Need for Resources

Companies can use the cyber risk quantification process results to determine what resources are required to reduce or eliminate current organizational threats and vulnerabilities.

Risk Management Decision

After a cyber risk quantification process, one can better understand their current security posture and related cyber risks to well-informed decisions about reducing this risk.

Automating the Process

Can automate cyber risk quantification to save time and labour. It means that technicians will not have to spend time performing cyber risk quantification on each piece of information technology equipment.

Cost-Effective

The overall cost of implementing cyber risk quantification will not be much more than processing a security vulnerability assessment.

Determining the Company’s Cyber Tolerance

Can use the information obtained for identifying and developing cybersecurity strategies for the foreseeable future. It means that the consequences of an attack during this planning period are less severe than those that would experience after a cyber attack once an organization has planned out their cyber security strategy.

Determining the Potential Cost of a Cyber Attack

Companies can use cyber risk quantification to estimate the cost of a successful attack and use this to determine how much money should be allocated towards mitigating the impact of an attack.

Planning Effective Training Programs

The results of a cyber risk quantification process can be used to create more effective training programs and plan for an organization’s IT infrastructure training needs.

How to Leverage on Cyber Risk Quantification

Cyber risk quantification can be leveraged on the following levels:

Organizational Levels

The senior management of an organization needs to determine the organizational level of cyber risk quantification. The level at which this model is used will depends on how large and how organized an organization is.

For example, an enterprise with thousands of employees or many systems will benefit from applying this model at a higher level (e.g., enterprise-wide) than a smaller company that runs just one corporate system.

Site Level

Organizationally focused cyber risk quantification methods can be applied to each site. It is the level at which most companies are structured; they have one or a few locations and may have dozens of sites. The IT personnel at each site may also not have direct access to all the data needed for an effective cyber risk quantification model.

Process Level

Many organizations are involved in processing large amounts of data (e.g. processing credit card information or handling employee information). These organizations can apply the same data processing methodologies to cyber risk quantification and perform a different amount of manual data analysis.

Asset Level

Cyber risk quantification can be applied to a specific asset (e.g., a server, router, switch). It is an effective method for performing cyber risk quantification on small network environments or those with limited access to the underlying devices on a network.

Information System Level

This level is useful for the entire IT infrastructure. Most organizations would benefit from a more holistic enterprise approach to cyber risk quantification.

Individual Asset Level

Some organizations may have large network environments that do not need a holistic enterprise-level approach to quantifying cyber risk. Some systems are relatively small and easy to manage individually with minimal use of IT resources.

Application Component Level

An individual application component (e.g. a web server) is typically not a significant resource on its own, and it has unique vulnerabilities that need to be fixed. In most instances, cyber risk quantification of an application component will include looking at its counterpart components. It would be a rare occurrence for those performing cyber risk quantification on an individual asset level.

Challenges of Cyber Risk Quantification

Cyber risk quantification is a challenging task because of the numerous variables can have an impact on how risks are quantified. Some of the most common factors that have to be considered when performing cyber risk quantification include:

Data Visibility

The amount of data for analysis is often limited in the cyber risk quantification process. It means that the available data has to be collected from a relatively small number of sources and then analyzed using an automated method.

Can’t Calculate Risk

Cyber risk quantification could be a better science. Often, organizations will need a higher level of understanding concerning the vulnerabilities they are trying to quantify and the impact a successful cyber attack would have on their company.

Partial Remediation

Sometimes, a company can perform some level of remediation, but not all of its IT infrastructure components. It is often the case in smaller companies where policy and security costs can be very high.

Time Frame of Analysis

Cyber threat intelligence is always changing, and so is the level of risk for an organization, even for an asset within that organization. Cyber risk quantification models must be set up to keep pace with these changes.

Data Manipulation

The information is also analyzed against other data that has been manipulated and stored for analysis. While this does not mean that all data is manipulated, it does mean that some data may have been tampered with or changed to alter the analysis’s findings (e.g., personal information).

No Consistent Methodology

Cyber risk quantification is not an exact science; therefore, it cannot be performed consistently.

No Standardization

The model used for cyber risk quantification may depend on the organization and the structure of its IT infrastructure. It is challenging to translate results from one organization to another or even use it across various industries.

No Known Method

Studies have shown that industry and IT experts do not widely accept any known cyber threat quantification methodology.

Conclusion

Cyber risk quantification stands as an emerging field in cybersecurity, that will undoubtedly play an increasingly crucial role in the future of cybersecurity for assessing organizational risk before potential attacks occur.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Network Portnox 2023