Case Study
Automatically detecting and remediating remote access exposures within minutes using Attack Surface Management (ASM) and automation from Cortex.
In brief
Industry
High Technology
Products and Services
- Cortex XSIAM®
- Cortex Xpanse®
Country
Global
Challenges
A major technology company operates a vast computing infrastructure of over 700,000 instances across AWS, GCP, and Azure. At such a massive scale, unintended exposures are inevitable. In some of their test environments, remote access services like RDP and SSH, which carry risks like ransomware and cryptojacking, were unintentionally exposed to the public internet.
Requirements
The Security Operations Center (SOC) team required an attack surface management solution that could:
- Rapidly detect exposed remote access services in all cloud providers
- Automate identification of service owners and operating environment to proactively remediate exposed risks
- Offer a high degree of configurability to tailor the solution to their needs
Solution
Over a period of six months, the tech company’s SOC team used the Attack Surface Management (ASM) Module in XSIAM to automatically remediate:
- More than 850 exposed RDP and SSH test instances
- Identified over 300 instances and confirmed that they belonged to exclusion lists at the folder, project, or instance level. It subsequently closed them as “Accepted Risk.”
CHALLENGE
Struggling to get control of exposed remote access services in the cloud
Organizations are increasingly adopting multi-cloud and hybrid cloud deployments for operations and product delivery, presenting security teams with the challenge of keeping up with the constantly evolving cloud infrastructure. Security teams need to maintain an up-to-date inventory, monitor for new exposures, and respond quickly to mitigate risks, especially due to the pace of modern attacks.
Research from Unit 42® and Cortex shows that organizations experience a 20% change in their cloud composition during a given month. As a consequence of this constant change, there are many opportunities for inadvertent misconfigurations to lead to unmonitored exposures.
Additionally, the 2023 Unit 42 Attack Surface Threat Report revealed that 85% of organizations analyzed had at least one internet-accessible Remote Desktop Protocol (RDP) instance online during the month. This is especially concerning when coupled with the 2022 Unit 42 Incident Response Report finding, which disclosed that brute-force credential attacks, predominantly targeting RDP, constituted 20% of the initial access methods. These findings emphasize the necessity to identify and resolve issues with misconfigured remote access services immediately.
The global tech company supports crucial operations for tens of thousands of customers worldwide. This includes various product offerings and operational workloads that are deployed across multiple cloud providers. The company’s security team wanted to quickly detect any exposed remote access services in all cloud providers and proactively remediate exposed risks.
REQUIREMENTS
Automation to identify, contextualize, and take action was a necessity
The tech company’s security team had several requirements that needed to be addressed in order to consider the solution a success:
- Continuous visibility for rapid detection of exposures: Their primary requirement was to have a current, complete, and continuous inventory of all of their cloud test resources. Additionally, they wanted to be able to identify any internet facing vulnerabilities on these resources in a timely manner. The company has over 700,000 compute instances deployed across AWS, GCP, and Azure. Because they have numerous accounts across the three major cloud providers, they needed an efficient onboarding process to configure access to these accounts.
- Proactive remediation of routine exposures: The SOC desired not only to have complete visibility into their cloud deployment but also the ability to take proactive actions automatically. Due to the large scale of their deployment, any solution requiring analysts to spend manual time on each exposure to triage or respond would strain their limited security resources and lead to responses with unacceptable delays.
- A high degree of configurability: Since the SOC was also planning to take automated actions, there needed to be appropriate safeguards and support for exclusions, organizational policies, and standards.
SOLUTION
Proactive Attack Surface Management with the ASM Module in XSIAM
For the global tech provider, the only choice was attack surface discovery and automation powered by the ASM Module in XSIAM.
The ASM Module in XSIAM is powered by the industry-leading Attack Surface Management solution Cortex Xpanse®.
Learn more about Cortex Xpanse® here. Cortex XSIAM® extended security intelligence and automation management is the AI-driven security operations platform for the modern Security Operations Center (SOC). By adding the Attack Surface Management (ASM) Module to your XSIAM deployment, you can gain comprehensive visibility across your attack surface, get immediate zero-day visibility, and automate the remediation of exposures.
The SOC used the ASM Module as a part of their XSIAM workflow to:
- Gain rapid visibility into the internet exposures on hundreds of thousands of cloud test resources.
- Utilize dozens of out-of-the-box playbooks and automation to solve common triage tasks, such as service owner identification, uncovering environment context, checking exclusion lists, and notifications.
- Go beyond just prioritizing and automatically remove vulnerable remote access services from the internet.
- Leverage workflows and technologies they were familiar with from Cortex XDR, XSOAR, and Xpanse.
BENEFITS
Over a period of six months, the SOC team used the ASM Module in XSIAM to:
A material reduction in business risk
With over 700,000 instances across AWS, GCP, and Azure, the tech company’s vast computing infrastructure inevitably experienced unintended exposures. However, the ASM Module in XSIAM automatically discovered more than 850 exposed RDP and SSH instances across test environments and was able to remediate them in a matter of minutes. Dozens more were addressed earlier in the year during non-prod infrastructure testing.
There were also many instances where the automation was able to confirm whether the remote access service belonged to an exclusion list defined at the folder, project, or instance level. On confirmation, these instances were closed as “Accepted Risk.”
Streamlining tools and reducing labor
Manually reviewing and prioritizing alerts would usually take an experienced analyst hundreds of hours. They would need to identify owners, investigate context, check exclusion lists, and send notifications. But with automation from XSIAM, the system handled all the alerts that didn’t require any security expertise or decision-making, leaving only the critical alerts that needed to be addressed by analysts. Additionally, creating, tracking, and reporting organizational metrics became much easier, because the detections, enrichment, and remediation all occurred within XSIAM.
Building on a tried and tested framework
With the implementation of this new automation, the SOC now possesses the technical means and the organizational awareness to start enforcing attack surface policies and resolve other types of exposed remote access services.
Increased organizational awareness about accidental exposures
Before taking any remedial measures, the service owners were notified about the security policies and were informed that their test instances were in violation of policies. The SOC sent two rounds of email notifications starting two weeks before the automated remediation. Due to these notifications, there was a 56% decrease in the total number of accidentally exposed instances prior to the commencement of automated remediation
CONCLUSION
The ASM Module in XSIAM helps SOC teams seamlessly integrate attack surface intelligence with the rest of their SOC workflows to secure their constantly changing attack surface. SOC teams that successfully move to this new approach will allow their organizations to thrive while securing and shrinking their growing attack surface.
Learn more about Cortex XSIAM® on our website.
Learn more about Cortex Xpanse Active Response on our website and the ASM Module in XSIAM.