Integrated Threat Management:
Activities to Boost Your Security Posture

August 18, 2022

Introduction

As access to technology evolves, so do the threats that stem from an expanding attack surface. The "check-the-box" method of cybersecurity is outdated and now regarded by most practitioners as insufficient. Compliance and other regulatory requirements with annual testing only add a point-in-time view and provide minimal real-world value to the delicate balance of vulnerability, threat, risk and consequence. To defend against the growing number and complexity of threats, companies need to be proactive, thoughtful and comprehensive in their defensive strategies.

This article illustrates how the integration of multiple threat management activities can be incorporated into a comprehensive and effective risk management strategy. To help in this endeavor, Optiv can lend expertise in various domains of information security, including application security (AppSec), incident response (IR), threat vulnerability remediation (TVR), risk analysis and more to secure their assets and information.

Case Study

A longtime Optiv client who historically purchased security products but not services reported events showing signs of a data breach. Customer data loss, regulatory concerns and fines were top of mind. Optiv jumped into action, interviewing stakeholders to understand pain points, objectives and areas of critical importance, which were used to devise a rapid incident response strategy.

Due to the client’s preplanning, Optiv's IR Team was positioned to mitigate the events suspected to cause the data leak. Committed to improving their security posture, the client partnered with us to establish critical reactive security measures that shored up security defenses and added logging as well as monitoring.

During this process, Optiv discovered servers and networks that were inadvertently exposed to the internet. One of these systems collected credit card data, which effectively classified the environment as part of a Cardholder Data Environment (CDE) as defined by the Payment Card Industry Data Security Standard (PCI DSS). Adding to the situation, the client used .NET, Java and Go as primary languages for custom software development, and these applications also contained sensitive data that were exposed due to insecure network design.

Most of the client’s data was hosted and stored in cloud environments while engineering teams used GitHub and Jenkins for building and managing code. Their high-impact business applications were critically overdue for security testing. Additionally, teams were progressing in the build-out of new application programming interfaces (APIs) without security in mind. Considering these factors, Optiv made the following recommendations covering the most relevant aspects of the client's business.

AppSec Services

In addition to AppSec, the client's network defenses needed evaluation, focusing on areas where an attacker could gain a foothold. As part of the incident response effort, Optiv’s Attack and Penetration (A&P) team conducted a series of tests to determine the effectiveness of the network’s defenses. The report output detailed a vast library of areas for improvement and was, in this case, leveraged by other testing teams.

A&P Services

Utilizing the collection of AppSec and A&P activities, Optiv collaborated with the client to bolster their defensive posture. Per the advisement from our experts, the long-term approach would include Cybersecurity Insurance Readiness (CIR) and Threat Vulnerability Remediation (TVR) services.

Optiv proposed CIR services to help the client understand and navigate the complexities of transferring cybersecurity risk to an insurance company. Their challenges were common to buying cyber insurance and included cost, business alignment and insurability. Our experts helped accelerate their path to obtain, maintain and reduce risk involved with cyber insurance.

Our TVR team’s testing activities uncovered high-risk issues, as well as several lower-severity vulnerabilities, then helped the client prioritize and plan remediation activities. Their goal, as in many organizations, was to prevent or minimize the effects of a breach. Optiv was able to staff vulnerability remediation consultants within their teams to assist with ongoing efforts.

Conclusion

This client’s story isn’t necessarily your company’s story. Optiv has teams of experts that can guide and tailor services to disrupt and mitigate the attack in times of need. We work alongside you to understand your specific needs, adding value with a host of experts for an end-to-end security solution that addresses your organization’s security goals.

For more threat team insights, visit our Source Zero platform, Optiv’s community of skilled individuals doing cutting-edge research and sharing their timely expertise.