What do they mean by “attack surface?” Simply stated, the attack surface is comprised of the totality of an organizations’ network environment that an attacker can attempt to exploit to carry out a successful attack, including all protocols, interfaces, deployed software and services.
So, if you were to look at your home’s attack surface, you would look at how a thief might try to gain access: open windows, unlocked doors, garage doors left ajar, etc. For homes, managing the attack surface is not that difficult since one would most likely notice if they have a broken window or a door that will not lock, etc. And as a safeguard, many people install alarm systems that will notify the owner and the authorities if an intruder is detected.
Taking that analogy back to the IT space, an organization’s attack surface also includes issues such as unpatched vulnerabilities, open network ports, out of date software and/or hardware, misconfigured networks, over-privileged users, weak network segmentation, security-unconscious employees – and the list goes on and on.
Unlike when defending a home, organizations have to deal with attack surfaces that include hundreds if not thousands of potential weak points that often change on a regular basis.
What is the Ideal Strategy for Defending the Attack Surface?
In an ideal world, security teams would simply reduce their attack surface to virtually zero by patching all known vulnerabilities, updating all hardware/software, correcting all misconfigurations and the like in real-time, etc.
However, in today’s hyperscale enterprise environment where new assets that expand the attack surface are added as business demand dictates, assuming that IT can achieve the goal of reducing the attack surface to near zero is simply unrealistic.
To manage this dynamic attack surface, organizations need to ensure they have the right set of security controls in place that reduce the chance that an attacker can exploit vulnerabilities within the attack surface.
These security controls should:
- Prevent zero-day payloads from executing
- Identify never-before-seen malicious behaviors
- Prevent common and uncommon attack vectors
- Understand when a user’s credentials have been compromised
- Take decisive, automated-response actions without the need for human intervention
Most of all these security tools need to be resilient and require minimal updates without degrading their abilities to protect the environment.
Leverage Cylance to Help Manage the Attack Surface
Cylance delivers a set of AI-driven solutions (CylancePROTECT®, CylanceOPTICS™, ThreatZERO™, Cylance Smart Antivirus™) designed to prevent an organization’s attack surface from being exploited. With Cylance, organizations can:
- Render zero-day payloads harmless
- Minimize attackers’ ability to exploit a computer’s memory
- Ensure servers remain in pristine condition - even if they go unpatched
- Protect cloud deployed assets from being harmed due to misconfigurations
- And more
Unlike other security solutions that require regular signature and/or rule updates, continuous cloud connections - and the streaming of sensitive data to the cloud to detect and respond to threats - Cylance delivers prevention, detection, and response capabilities driven by an AI model that is completely local to the endpoint.
This means all threat decisions are made local to the device, server, cloud, and user environment, eliminating response latency that is common with other tools. Additionally, this local perspective on threats ensures a continuous security posture even if the asset is not connected to the network.
CylancePROTECT®: AI-driven threat protection that gets out in front of malicious cyberattacks with the data science driven power of artificial intelligence (AI). CylancePROTECT works where most attacks occur - at the endpoint - for better efficacy, faster resolution, and less disruption.
CylanceOPTICS™: Prevent, detect and respond with CylanceOPTICS, which uses machine learning (ML) and artificial intelligence to identify and prevent widespread security incidents, providing consistent visibility, targeted threat hunting, and fast incident response.
ThreatZERO™: Proving prevention is possible, ThreatZERO experts blend technological expertise and personalized, white-glove service to optimize Cylance security solutions so customers get the most out of tier investment by realizing a protected environment that runs smoothly, accountably, and effectively.
Request a Custom Demo
Try as they might, IT teams will never be able to eliminate their attack surface. Fortunately, organizations leveraging Cylance can rest easy knowing that even if vulnerabilities go unpatched, misconfigurations exist, or users are careless, Cylance can prevent attempted exploits of these weaknesses from being successful. Contact us today to learn how.
