How to Continually Test Security Controls and Boost Security Posture


By Jeff Broth

Security testing is crucial, especially as cyber threats continuously evolve with no signs of stopping or slowing down.  To achieve the best outcomes from the security solutions employed in an organization, it is not enough to have the best tools and keep them up to date. There has to be a systematic way to test security controls, increase security visibility, detect security gaps, and automate security assurance programs.

End-to-end attack simulation

The go-to security test for most organizations is pen testing, wherein cybersecurity experts purposefully attack a network to identify security flaws, leaks, vulnerabilities, or exploitable defects. However, traditional penetration testing has ceased to be the highly effective testing tool it once was. With the rapid evolution and overwhelming frequency/volume of cyber attacks, organizations need something more advanced and deep-reaching. Relying on traditional pen testing can be a vulnerability itself. 

This is where the idea of a continuous security validation platform comes in. Instead of doing penetration testing periodically, the tests are conducted indefinitely. To make this possible, automation is employed to significantly reduce the cost and manpower involved in the process.

To illustrate how easy it is to undertake end-to-end attack simulations, we go over Cymulate’s web application firewall (WAF) dashboard below as an example. It automatically examines the performance of the WAF system in place and presents insightful summaries for both WAF sites and payloads.

Information or indicators about the actions that can be undertaken to resolve site and payload concerns are shown. Sites that do not have issues show with the green Domain Ownership Verified indicator, while those that require action are presented with the red Pending Domain Verification indicator along with the Verify button, so security officers or administrators can proceed to verify them as they deem appropriate.

Image credit: Cymulate’s Web Application Firewall dashboard

Greater security visibility

It is inevitable for many organizations to make use of various security tools or solutions, which may come from different vendors. This can create inefficiencies and discourage optimization. It can be tedious and challenging for organizations, especially those that do not have experienced IT teams, to verify the efficacy of these security tools.

A security validation platform addresses this problem by integrating different security controls under one intuitive dashboard. This makes it easy to regularly monitor the operation of different security tools and determine if they are working as expected or encountering issues and rendered ineffective.

The best platforms incorporate the MITRE ATT&CK framework to leverage information about the latest adversarial tactics and techniques. It comprehensively examines the security controls of a network based on novel methods and strategies that are likely to evade existing defenses.

Automation

Simulations can be automated with scenario variations automatically implemented with the help of an algorithm or artificial intelligence. A purple teaming approach is an excellent example of cybersecurity testing automation. It can be set to undertake endless attack simulations and generate organized reports for faster evaluation and response.

Cymulate can integrate incident response playbooks from other systems as part of the automation process. For instance, it can reference the incident response playbook of the Palo Alto XSOAR platform to more efficiently handle specific types of threats.

Image credit: Cymulate’s Palo Alto XSOAR Incident Response dashboard

Quick remediation

Security control testing is not just about evaluating the effectiveness of security controls. It also has to come with quick and easy remediation. Setting aside the findings of the simulations and other security testing procedures for later remediation is an ungainly way to conduct security validation. 

Instead of aggregating simulation and testing findings for major periodic remediation, it is advisable to remediate as problems are found and identified.

Robust threat intelligence and reporting 

It is important to have a robust threat intelligence and fast security test reporting system. Cymulate’s Immediate provides an excellent way to catch and stop clear and present cyber threats. It provides an easy-to-process summary of all threats evaluated during the simulation process to bolster an organization’s security posture.

The Immediate Threats Intelligence Assessments dashboard shows the dates of the tests conducted, names of the threats targeted, corresponding scores, vectors, and statuses. As part of Cymulate’s emphasis on actionable insights, this dashboard also shows convenient action buttons that allow security officers to perform actions such as copying the details and deleting the test details. Additionally, the dashboard has buttons for instant report generation.

Image credit: Cymulate’s Immediate Threats Intelligence Assessments dashboard

In summary

Again, having the right security controls is not enough. It is vital to undertake tests to ensure their efficacy. The process needs to be done in a systematic manner.


Jeff Broth is a business writer and advisor, covering finance, cyber, and emerging fintech trends. He has consulted for SMB owners and entrepreneurs for eight years.


Follow Brilliance Security Magazine on Twitter and LinkedIn to ensure you receive alerts for the most up-to-date security and cybersecurity news and information.