Continuous security controls validation: a CISO’s secret weapon

Preparing your organization for the next big threat is no easy task, but there are tools that can help

Picture this: A Chief IT Security Officer (CISO) is speaking before their company’s board of directors, and one board member asks a series of difficult questions. ‘What did we get for the USD15 million we spent on cybersecurity last year? How can we measure our return on investment? How do we know our security defenses are actually providing us the security we expect?’ For many years, it’s been difficult for CISOs to supply metrics. While many have been able to tell board members how many attacks their security teams and technologies mitigated each year, it’s often been hard to give additional context by explaining exactly how effective their security measures were, plus what they did to get them to that stage of effectiveness. For many years, it’s been difficult for CISOs to supply metrics.

Enter breach and attack simulation

In recent years, however, smart companies have had a more aggressive method to continuously test security controls via breach and attack simulation (BAS). These security controls validation platforms provide an automated and continuous simulation of a variety of cyberattacks, including insider threats and lateral movements by attackers, giving companies constant feedback about the effectiveness of their security measures benchmarked against the MITRE ATT&CK framework.

These controls validation platforms use machine learning and other automated tools to continuously probe a company’s IT environment for weaknesses. As a result, CISOs are continuously armed with the current information they need to support the business case for cybersecurity resources when addressing the rest of the C-Suite and board of directors. In some cases, that may mean asking for a cybersecurity budget increase to address deficiencies the security controls validation platform has identified, but in other cases, it may mean validating the existing cybersecurity budget as a good return on investment. BAS is viewed as a useful tool by leading technology companies, such as Splunk. In fact, Splunk’s VP, Product Management, Security Jane Wong recently said: ‘In lock step with our partner community, Splunk integrates with attack simulation tools and leverages best in class capabilities for important customer outcomes. With breach and attack simulation, the Splunk ecosystem gets actionable metadata to enable customers to not only validate the efficacy of their controls, but to ensure automated response is in place for any attacks that are simulated.’

These controls validation platforms use machine learning and other automated tools to continuously probe a company’s IT environment for weaknesses.

Don’t replace, but add on

It’s worth noting here that breach and attack simulation isn’t intended to replace other cybersecurity measures and controls. It’s another important part of a holistic cybersecurity operations model and, used in conjunction with –real-time threat detection and response (containment and isolation), can help companies move toward a stronger security posture.

Some companies may be tempted to use controls validation platforms to replace periodic penetration testing or red team attacks – human-led evaluations of a company’s cybersecurity posture. And though there may be some overlap between the two approaches, there’s value in using both. Penetration testing, for example, can be something done randomly every few months whereas a controls validation platform works continuously.

Penetration testing or red team attacks can bring a human element into attack simulations, and the use of a security controls validation platform can help focus a red team attack on areas that a company believes may need additional scrutiny. In return, red teams may be able to point out methodologies that can be used to expand the controls validation platform.

Is your organization ready for the next big threat? Find out how cyber-resilient your business is via this cybersecurity maturity assessment