Describe exposure management without using the word 'exposure'.

"Describe exposure management without using the word 'exposure'."

I was asked about this mid-podcast. I answered in about two seconds: a guiding light for the security team.

It didn't take more than 2 seconds because this is how I picture the entire exposure management program.

Quite contrary to the popular belief, Exposure Management isn't just a glorified version of vulnerability management.

"Exposure Management is a much wider and bigger umbrella."

Common thinking, threat exposure comes from:

- Vulnerabilities

- Misconfigurations

Exposure thinking, threat exposure comes from:

1. Vulnerabilities

2. Misconfigurations

3. Lack of security controls or coverage

4. Ineffectiveness of security controls

5. Lack of detection coverage or SOC coverage very few companies feed application logs to SIEM/SOC

6. Risky user behaviour clicking on links in emails coming from external parties within seconds of arrival

7. Ineffective and outdated governance policies such as patching within 30 days, etc.

And many more.

These exposures then go as an input to your security program and answer these questions:

1. What attacks are possible in my environment?

2. Which assets can probably be used by attackers to gain an initial foothold?

3. Which threat actors commonly use these exposures to launch attacks?

4. What's the business loss expectancy because of these exposures?

5. How much investment would be required to put a control on these exposures?

6. Which exposures can be immediately fixed, and which need long-term design or process changes?

7. What appropriate controls would be required to fix these exposures?

Imagine the irony if we are taking antibiotics for virals? You can feel good about taking medicines but it won't help.

This is how exposure management can be the guiding light to the entire security organisation.

And yes, this won't be possible if you assume the Exposure Management program to be sitting on the left side of security operations.

We like to commonly say shift left, but let's understand left doesn't talk to right, and these are poles apart.

So in order for exposure management to be the guiding light, it has to sit in the centre and core, to guide left, right, top and bottom.

Let's start by saying, let's move Exposure Management to the centre and core.

Exposure Management is not a tactical program, it is strategic.