Net Zero Vulnerabilities

Suchit Mishra — 5/25/2023 — 4 Min Read

It’s amazing

With a blink of an eye

With a blink of an eye

You finally see the light

It’s amazing

When the moment arrives

You know, you’ll be alright

-Aerosmith

Imagine a security dashboard, with zero security vulnerabilities pending to be fixed. Wouldn’t that be a sight!

Photo Credits: Appolinary Kalashnikova on Unsplash

Every security team’s dream is to have the development and IT teams remediate issues as per the SLA agreed upon at the onset. The reality is security bug fixes get kicked around from one quarter or release to another due to business priorities overriding the security urgency. The fact is also that security breaches are not a matter of if but when, and that is gradually sinking into the psyche of C-level and Board members alike. Where most security teams struggle with, is a prioritization of which vulnerabilities need immediate attention over the ones that can wait.

Often security professionals get caught up in the minutiae of the individual technical issue rather than focusing on the business impact of what could go wrong if the issue weren’t addressed. So how do you get non-security teams to pay attention and fix the security vulnerabilities in a timely manner?

In today’s world, where data is being democratized within organizations, even the security of data should be democratized and crowdsourced. Every company today is a data company and data is like oil flowing in and out of the organizations. So, why not use business-sensitive data at-risk as the security vector to prioritize fixes!

What if the security team could objectively contextualize how much data would be at risk of exposure in the event of a vulnerability being exploited? No company wants to be in the news for the wrong reason, like a data breach, and no employee would like to get fired for not fixing a legit security issue with severe consequences. Unfortunately, in the past, security teams lacked the visibility to provide a view of at-risk data for the constituent teams to act upon. This is no longer an impediment in the modern cloud-native environment.

Guardrails vs. Gatekeepers

In modern fast-growth corporations, it’s vital for the security teams to shift their mindset towards quicker detection of vulnerabilities and prevent bad habits from forming within the organization. The cultivation of good data security practices between employees will go a long way towards building good hygiene within the organization. This is a move away from conventionally rigid remediation methods that blocks anything looking risky.

Stopping engineering and data teams from accessing necessary company and customer information required for business operations is not the solution to security problems. Instead, equipping the respective business and tech teams with the data risk exposure and its adverse impact will help move the needle much more effectively. Despite all the innovations in the cloud and security technologies, it’s still very hard for security and even compliance teams to answer these fundamental questions:

Where is all the company data?

What data is sensitive or at-risk of exposure?

Who has access to the sensitive or at risk data?

How is the data being used?

Most data breaches are a hush-hush affair and pushed under the rug quickly because organizations struggle to have a clear inventory of their data, and find it hard to map it back to a data classification model to conduct a thorough business impact analysis.

Taking all of the above pain-points into account, here’s a proposed sequence of activities that should be performed automatically at-scale to manage the data exposure risk:

Discover: Identify the various types of data within your organization viz. structured, semi-structured, unstructured.

Classify: Apply machine learning to find the different types of data like payment cards, health info, personal info, intellectual property, etc., and map them based on the data sensitivity classification.

Tag: Label the data so you know where is what type of data and how much of it is there for better tracing in the event of a breach.

Detect: Look for data exposure risk anomalies such as unencrypted data, dark data, shadow data, and orphaned data, that can lead to unauthorized access.

Remediate: Apply necessary security measures like encryption, masking, multi-factor authentication, and authorization to adequately protect the data while powering the business to operate efficiently in the cloud.

Conclusion

Companies going through a digital transformation journey or preparing for an IPO need to take a data-centric approach to visualize the data as it flows through the cloud infrastructure to manage the confidentiality and integrity of their crown jewels. This situation becomes even more pronounced if the data is widespread across multiple clouds.

In the past, companies would leverage a combination of solutions like data loss prevention, database activity monitoring, and identity access and management, along with strict firewall policies to block data exposures. While this made sense in the old ‘castle and moat’ security model, this old approach completely falls flat on its face in modern fast-moving cloud-native organizations. Taking a data-centric security approach coupled with good visibility and contextual view of the data can influence constituent teams to fix vulnerabilities promptly and to get to 0 vulnerabilities security teams dream of.