Introduction
Fifteen years ago, I never realized that one point twenty-seven centimeters was the difference between keeping my family safe and having an intruder break into our home.
Yet that is exactly what happened. We came home one night and did not know intruders were already in our basement; and the only reason we were alerted to their presence was when they attempted to move to the upper levels after we had gone to sleep, and the main floor motion sensors triggered an alarm.
Fortunately, they fled. Some stolen electronics and a broken door were all the damage we suffered – and we realized how lucky we were as things could have ended up a lot worse.
![](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959a5eb6f185e80eaa4208_066650de.jpeg)
Fortunately, they fled. Some stolen electronics and a broken door were all the damage we suffered – and we realized how lucky we were as things could have ended up a lot worse.
The culprit of the successful breach? Screws measuring 1.27 centimeters (that’s a half-inch if you’re not on the metric system yet) that held the glass windows of our basement French doors. Despite having door opening sensors and glass breakage sensors, we missed that the glass panel could be forcefully kicked out – and land – onto the carpeted floor. No door was opened. No glass was broken (we used to have cats that roamed the basement, so motion sensors were not an option when we first moved in). The screws were not long enough to better secure the framing of the window.
Continuous Threat and Exposure Management
What does this have to do with CTEM, or Continuous Threat and Exposure Management? Well, once our situation changed and our cats were no longer with us; we a) did not reassess our detection capabilities and b) still did not realize we had a vulnerability exposure that could lead to a breach.
I fell into the same trap many organizations fall into where point in time assessments can create a false sense of security. Instead, CTEM offers a cyclical approach to assessing risk that involves five stages:
![](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66995b32532cfefc4522aab0_a6181015.jpg)
Scope: To adopt a CTEM approach, organizations should first identify key business programs. There should be an understanding for each program what the impact to the business would be if something were to occur. An organization can, and most likely will, have multiple scopes defined as part of the CTEM process. For example, your customer relationship management (CRM) project may encompass a Saas solution such as SalesForce, tie-ins with selling partners, supply chain vendors, and multiple user groups (sales, finance, etc.).
Discover: Next, identification of systems, applications, and SaaS subscriptions that support the business program should be accounted for and documented. As you build out risk profiles for these assets, I believe it is also important to identify associated users (end-users, administrators, etc.), especially since user error / account takeover is a favored attack vector.
Prioritization: Proper prioritization is essential to a solid CTEM program. I go into more detail about Risk-Based Vulnerability Management (RBVM) later; but for now, prioritization deals with measuring the potential impact based on factors such as: prevalence of an exploit, lack of controls, program / asset criticality, and available mitigations.
Validation: This stage helps identify if an adversary could launch a successful attack. Red team exercises and breach simulation solutions are often utilized to exercise the organization’s ability to halt an attack before damage is done. Validation should go beyond the initial stage of the attack and explore available methods to reach the adversary’s mission objective.
Mobilization: Identified responses to breach attempts should be categorized into automated or manual processes. Automated response solutions such as Security Orchestration, Automation, and Response (SOAR) can be integral in ensuring actions are taken with appropriate authorization, remediation / response times are rapid, and procedures are executed without human error.
A properly managed CTEM program will help ensure survivability and rapid recovery when an attack occurs as well as minimizing the risk of an attack being successful. This also helps organizations move towards a more proactive security posture.
Implementing a Risk-Based Vulnerability Management Program
Now don’t get me wrong. I thought I had done a pretty good job covering the bases when we first moved in. I walked the alarm company “expert” through every room of the house, and we discussed every possible entry point. I ensured that every avenue of access was covered by two types of sensors. I asked questions about how an intruder was most likely to attempt to gain entry and ensured we had addressed the exposure.
![](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959ab5fc8c6322d511c610_6e91404f.png)
I relied on the expertise of someone that while they worked for an alarm company, was not actually trained and experienced in criminal break-ins. At the end of this paper, I will list the recommendations made by a friend of ours that was a Deputy Chief of Police. Hint: It was eye-opening.
Risk-Based Vulnerability Management (RBVM) is an approach that helps organizations not boil the ocean (try to address every possible vulnerability that may exist) and avoid becoming myopically focused that you miss an attack path that is relevant.
Without expending the entire blog on all the details of CTEM and RBVM, let’s touch on the main components.
Vulnerability Scanning
Vulnerability Scanners can help you identify all the vulnerabilities that exist in your organization but are generally a point in time view. Update systems or applications, change configuration settings, deploy new systems or applications and the scan data may be meaningless – not to mention new vulnerabilities are discovered all the time.
CVE, or Common Vulnerabilities and Exposures, is a compilation of all known vulnerabilities. I emphasize known because adversaries love finding zero-days (and for how I describe zero-days, check out my LinkedIn posting: Race to the Bottom).
CVSS, or Common Vulnerability Scoring System, is a method to define the severity of the vulnerability. Scoring can be determined by things like complexity and skill to utilize the vulnerability, privileges required, what type of attack path is needed, and if user interaction is required to trigger the vulnerability.
CVE and CVSS however, do not address context of the vulnerability in an organization’s environment. A small number of vulnerabilities will account for the most risk in an organization. Remember, adversaries don’t care about risk scores…. If it gets them in, they will use it.
EPSS, or Exploit Prediction Scoring System, estimates whether a vulnerability is likely to be utilized by adversaries and provides an indication of the threat level to the organization.
Another nuance is ensuring you understand how the scanner is gathering and reporting vulnerabilities. One of my favorite questions to ask candidates I’ve interviewed is “How can two scanners interrogate the same system, where nothing changed in the system, both scanners executed flawlessly and knew to scan for the specific vulnerability…. yet one reports vulnerable and the other reports not vulnerable?” I had this occur, and the answer was that one scanner interrogated the running service, and based on how it responded could determine if the vulnerable version was running. The other scanner authenticated into the system and checked patch level installed – but the service/system had not been restarted. The configured state was NOT vulnerable, but the running state WAS vulnerable. This happens a lot after Microsoft Super Tuesday patches go out and users login and think “I’ve got work to do; I will reboot later”.
External Attack Surface Management (EASM)
Simply put, you can have a vulnerability, but if there is no path to exploiting the vulnerability, then the risk should be lowered. Even a high severity vulnerability is not a risk if it cannot be exploited, whereas a low-risk vulnerability (like 1.27cm screws) can provide a path to success for the adversary. EASM solutions were built to provide that context: Vulnerability + Exposure. BTW – I would not neglect Internal Attack Surface Management for potential Insider Threat risks.
Breach and Attack Simulation (BAS)
![YARN | On my mark, rotate launch keys to "launch." | WarGames | Video gifs by quotes | 24d1705c | 紗](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959ad168253de3563f6b60_19549187.gif)
It’s one thing to list vulnerabilities, another thing to say there are exposed systems with those vulnerabilities that could lead to an attack. But executing an attack simulation that shows you what the potential outcome(s) are if an attack occurred? This is what BAS solutions were built to assist with, and not only show attack paths ripe for exploitation, but also exercise SOC / IR teams in nearly real-world situations. Table-top exercises are good for verifying processes, but live-fire exercises are imperative to ensure your teams respond quickly and precisely when the real deal occurs (don’t make me whip out the beginning of Wargames on you, I’ve already used that movie twice before!).
Risk-Based Context
I’ve often wondered why it’s 2024, I’ve been doing this for 30+ years, and breaches are still inevitable and security teams still struggle with many of the same issues they faced when I first got into this career.
I believe not addressing an RBVM approach could be one of those reasons. It’s not a priority if you have a vulnerability on a system that is not exposed for exploitation. It’s not a priority if a vulnerability has been mitigated by other compensating controls. Focusing solely on vulnerability scoring without regard to whether the vulnerability poses a real and credible threat to your organization diverts focus away from vulnerabilities that matter (this is the same mantra you will hear me evangelizing around SOCs expending time on alerts that do not matter).
When assessing context, I think of it in the following manner:
![](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66995c7b679462c13856f906_Screenshot%202024-07-18%20at%2011.18.24%20AM.png)
How Can Darktrace Help with your CTEM?
The Darktrace ActiveAI Security Platform is designed with CTEM in mind. Using patented AI capabilities at its core, components of the platform work in harmony to provide actionable intelligence to risks facing the organization.
PREVENT/ASM utilizes AI to help understand scope and what makes externally facing assets yours while providing associated risks and trends on the risk types identified. These findings are communicated to DETECT and RESPOND to harden critical paths.
Prevent/End-to-End (E2E) delivers attack path modeling for discovery and prioritization of high-value targets across all assets in your program’s scope, providing continuous visibility into relevant risks the organization faces. E2E also utilizes AI-generated social engineering generated content for Breach & Attack Emulation scenarios involving Phishing / Spear-Phishing attack vectors.
Darktrace threat detection and autonomous response utilizes unsupervised machine learning at its core to identify anomalous activity, and if malicious events are occurring, enforce Pattern of Life allowing business operations to continue while stopping the breach from progressing. This provides unprecedented speed of response to emerging threats.
So, ensure you’re addressing vulnerabilities in the proper context, because you never know when 1.27cm will ruin your day.
Appendix A: Deter Burglars from Breaking into Your Home
Another question I have asked candidates centers around what security controls they would implement to keep an advanced adversary away from a highly classified project; and shockingly, very few would mention any physical security controls or use of air-gapped networks. So, as promised, here are some recommendations from our Deputy Chief of Police friend on better securing your home, because we must protect ourselves, our information on our home and work computers, especially for remote staff:
![32 in. x 80 in. Rustic Knotty Alder 2-Panel Square Top Left-Hand/Inswing Grey Stain Wood Prehung Front Door](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b661466807f75af6ad1_fafb12f8.jpeg)
- Solid (no glass) doors that open outward for rear / side entryways – a kicked door will press against the framing providing stability. Hinges should not be exposed to the outside.
![STASUN LED Flood Light Outdoor, 150W 15000lm Outdoor Area Lighting, IP66 Waterproof Exterior Floodlight Commercial Security Light, 3000K Warm White, 3 ...](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b66eadcf8da531ebb2e_50c7df0e.jpeg)
- Motion activated exterior flood lights – illumination is the enemy of thieves.
![Mortise Lock Set Screws (2 Screws Per Pack)](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b66b5ce2b0f044899f7_f5f5da9a.jpeg)
- Replace door hardware lockset screws with minimum 4-inch (that’s 10.16 centimeters) screws on all doors including interior ones – this should ensure screws firmly attach to trimmer and king studs in door frame and will add additional valuable seconds for the intruder to break through
![home security Memes & GIFs - Imgflip](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b667a168689a65dba45_3d1079b4.jpeg)
![Dog Food Bowl](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b66544ec4011c009c77_7620bf0b.jpeg)
- Get a dog – a big dog. (I’ve amended this to include putting out fake dog bowls to make it look like you have a big dog!)
![SPT Interior/Exterior Simulated Security Camera](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b65eadcf8da531eb9ff_c939bb1f.jpeg)
- Exterior video cameras – record and alert on activity around the house
![LARSON Platinum Secure Glass Full-view Aluminum Storm Door With Quickfit Handle | Retractable Screen Door Lowes | universoprofesional.com](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b65af65a0de0ed3c696_c7a72939.jpeg)
- Tempered Safety Glass Storm Doors – whack at it for hours with a baseball bat and they still can’t get in
![Should You Install Fake Home Security Yard Signs? – Forbes Home](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b66f37b0ec286413cee_400a83f4.jpeg)
- Alarm system warning signs for windows and doors
![LG Electronics Recalls Free-Standing 86-Inch Smart Televisions and Stands Due to Serious Tip-Over and Entrapment Hazards (Recall Alert) | CPSC.gov](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/66959b66e6cadc788d061492_85421de6.jpeg)
- Pictures of valuables along with serial numbers (this won’t stop a break-in but could help in recovery of stolen items).
- Finally, an alarm system combining motion sensors with door/window sensors.