网络资产攻击面管理(CAASM)

How Does CAASM Work? 

CAASM通过考虑网络资产的互联性和整体性来工作, analyzing their vulnerabilities, 然后制定降低风险的政策. CAASM常见的关键绩效指标包括: 

• Asset visibility 
• Endpoint agent coverage
• Service-level agreements (SLAs)
• Mean-time-to-respond (MTTR)

As mentioned above, assessing each vulnerability can become cost and time-prohibitive when there is such a multitude of assets to consider on one network. Automation helps by analyzing vulnerabilities faster as well as prioritizing them for remediation.

CAASM使组织能够利用分析来优化搜索结果, identifying trends, 或者向特定的群体或个人传播特定的信息. 这种集成的方法提供了全面的攻击面可见性和映射 so a SOC can address risks and manage vulnerabilities more efficiently.

Perhaps the most critical function of CAASM is the identification and mapping of new assets as they plug into and out of a network. It’s important to leverage comprehensive asset discovery tools to gain a true picture of what a changing attack surface looks like as those new assets appear. Network access control (NAC) 功能还可以帮助创建策略，以减少未经授权的访问尝试, 不良行为者是否应该利用尚未被识别的资产漏洞.

From there, security personnel can more easily define specific outcomes for assets or asset groups. 一旦这些结果确立, it’s simply a matter of running searches for all assets that do not meet these security criteria and subsequently prioritizing them for remediation. In this way, CAASM helps a SOC streamline inventory and remediation practices to help it gain greater efficiencies.

CAASM与其他技术有何不同?

CAASM在许多方面不同于其他技术，但在其他方面也有相似之处. There are so very many platforms and methodologies out there to help security practitioners ensure their attack surfaces are as protected as they can possibly be. 在查看攻击面防护解决方案时, what are some key differences a buyer might consider before purchasing the right solution for their organization?

CAASM vs. Attack Surface Management (ASM)

Continuous attack surface management (ASM) 始终监控组织数字足迹的总体概念是什么, 目标是缩小攻击面，加强公司的安全态势. ASM包含了我们将在这里讨论的所有方法. CAASM is essentially ASM through the filter of all of an organization's cyber assets on its network or that are attempting to access its network, both internally and externally.

CAASM vs. 外部攻击面管理(EASM)

The main difference between EASM and CAASM security is that the former typically focuses solely on external-facing assets while the latter focuses on both external and internal network assets, 因此，在任何给定时间都可以获得攻击面更完整的图像. 因为与CAASM相比，它更简单, EASM解决方案往往更容易设置，因此被更广泛地采用.

CAASM vs. Digital Risk Protection (DRP)

While CAASM solutions tend to focus on internal and external network assets – and therefore the data they share with the network and take off of it – a DRP solution typically aims its focus on an organization’s sensitive digital assets and their exposure to the internet and potential attackers as well as vulnerabilities that could result from that exposure.

CAASM Use Cases

Let's take a look at the situations that would most call for implementation of a CAASM solution to help protect an enterprise network as the proliferation of cyber assets creates more vulnerability.

• Inventory and mapping: Maintaining visibility over a detailed – and automated – inventory of the cyber assets growing a network’s attack surface is the overarching mission of a CAASM solution.
• Optimize vulnerability management (VM) workflows:通过定义资产结果和细化过程使其更加自动化, vulnerabilities can be spotted, prioritized, and remediated faster than ever. This means a stronger security posture for the attack surface as well as the ability to take more proactive measures as telemetry dictates.
• 维护合规性需求完整的资产清单对于维持监管和内部管理至关重要 compliance requirements. Typically, CAASM solutions will come with built-in compliance frameworks that help an organization adhere to the likes of NIST, SOC2, and others.
• 识别易受攻击的应用服务器: A CAASM tool can help to find application servers that are contextually exposed for exploitation as well as identify owners based on login telemetry. 从那里，可以通知服务器所有者和安全团队. 这种集成的方法提供了全面的攻击面可见性和映射.
• Ensure access management: As noted above, NAC controls can accentuate CAASM tools so that authentication protocols are aiding in the effort to verify assets that have a right to be on the network. 安全人员可以利用CAASM 身份和访问管理(IAM) policies to quickly remediate incorrectly escalated privileges as well as better understand who and what are on the network.

Benefits of CAASM

ASM的目的是缩小所谓的攻击面, 这样一来，攻击者破坏网络的潜在接入点就会减少. But as we’ve discussed here, more assets interacting with an enterprise network means a greater proliferation of access points.

Implementing an effective CAASM solution can help to mitigate these concerns as more assets come onto the network. 让我们来看看这种解决方案的一些好处:

• Lower risk profile: With regard to security automation, IDC has noted, “using continuous automation tools to discover externally exposed assets helps an organization address risk in previously unknown assets with both a frequency and breadth that are possible only with automation.”
• 减小攻击面大小: It bears repeating: A shrunken attack surface is a smaller target for threat actors and potential breaches. Leveraging automation to plug vulnerabilities quickly as well as employing network access authentication tools can help a security organization achieve its goals as relates to shrinking its network attack surface.
• Strengthen partnerships随着IT团队习惯于从网络上和网络下的资产中共享数据, security teams can leverage the automation native to CAASM tools to sift through that data faster. This helps to create efficiencies in discovery of both vulnerabilities and any active exploitations.

CAASM平台并不是网络资产管理的即插即用解决方案. Indeed, it will take the skill of experienced security practitioners to properly implement such a solution. But the value derived from a well-maintained and effective CAASM tool will mean a stronger and more secure network.