Considerations

The ASM/CV Journey: Building an Adaptive Approach

Using key questions to identify considerations and options

In the same way that there is no standard list of assets an enterprise needs to protect when evaluating potential vectors for intrusion, there is no “one-size-fits-all” method to defining your ASM/CV approach. Plotting an ideal course of action starts with addressing key questions that clarify your specific ASM/CV needs and point to an appropriate course of action.

Key factors in defining an ASM/CV approach

[Source: Stratascale 2021]

Using key questions to identify considerations and options (continued)

1. Scope of perspective. The first question most organizations will ask is some variation of, “What are we trying to accomplish?” Broadly speaking, the answer to the question could reflect a tactical concern—“How do I protect my remote workers?”—or a more strategic consideration, such as, “How do I evolve discovery with changes in my environment?” These questions in turn lead to other evaluation factors, including those that relate to cost, capability, and migration options.

Top level question: Is the scope of the issue we are trying to address more of a tactical objective or more of a strategic concern?

If the response is “tactical,” a set of follow-on questions helps drive the selection process:

What kinds of solutions do we have in-house skills to support?
What is our immediate priority? Cost? Level of effort required to adopt the new solution? Or how quickly it can be deployed?
Will this objective become more complex over time, or are we strictly looking to solve for the current problem?

What is our long-term vision for this solution? What capabilities do we hope to gain from its adoption?
How must this solution expand to meet new use cases or requirements over time?
What existing portfolio products will this affect? Which can we unplug and which will need to integrate with the newest toolset?
Do we have the skills necessary to run the new solution, or do we need to take further action?

The question of a feature's or function's fit is really one of rationalization: "How do we achieve optimal protection without paying for or managing capabilities that overlap with ones we already have, and without leaving gaps in the shields that protect our users, data, applications, and critical environments?
The technical question is different in kind: "Do we have APIs—or other means—to ensure that we aren't deploying an 'island of automation' that won't integrate with our current environment?"

Using key questions to identify considerations and options (continued)

An organization that is addressing a strategic concern rather than a tactical objective will ask a different set of questions through the evaluation process:

2. Existing technology stack. The strategic vs. tactical issue hints at how your installed technology stack impacts tool and solution selection. Here, the key questions are: “How will the new tool’s capabilities align with our portfolio’s existing capabilities? Can we integrate the new product into our current environment?”

Using key questions to identify considerations and options (continued)

3. Balancing protection and performance. In many ways, security is like insurance: critical when needed but best if its capabilities and limits aren’t tested. In this analogy, a “monthly premium” correlates to the impact scans have on production environments’ performance.

While some technologies have no or very limited impact on production systems, others—including those that perform scans on operational technologies in IT/OT environments—may have an obvious negative performance impact.

Key question: What current price are we willing to pay to protect against future threats?

If the performance cost of protection is minimal, this question is irrelevant. When that isn’t the case, this query leads to a variety of follow-on questions:

"What is the cost and safety downside of suboptimal system performances?"
"What is the worst scenario that might arise from a breach—and is this risk tolerable?"
If the answers to those two questions can't be reconciled, a third may need to be asked: "What are the strategies for delivering both performance and protection, and what are the associated costs?"

Bottom line: Performance vs. protection isn’t always a dichotomous issue, but when it is, it is both critical and complex.

Using key questions to identify considerations and options (continued)

4. Opportunity for automation. As with performance vs. protection, the question of whether there is an opportunity to improve ASM efficiency through automation doesn’t always arise. Advanced automation might be built into a tool, or it might be so limited that it’s irrelevant. But as this report has shown, ASM automation provides real benefit—so the key question should be, “How do we effectively deploy automation to improve the reach and effectiveness of our ASM approach?”

Two questions help bracket the automation issue. They highlight the entry point and future directions available to an enterprise and agree on the idea of transparency:

Can we automate a function or process? The first question relates to documentation—do we understand how this issue is addressed to consistently arrive at the right outcome? If the answer is "no," then follow up with, "What is the best way to consistently resolve this issue?"
Can we capitalize on advanced AI/ML capabilities? The performance and scale potential of AI/ML is clear, but the process by which AI/ML delivers on this promise is not. Before committing to a solution, ask, "Can your software explain how it arrives at an understanding?"

These four primary questions, and the issues that they raise, will help the CISO define an approach that delivers both effective defense of the attack surface and ongoing continuity of security operations.