Vulnerability Detection and Response Thwart Lateral Movement

Cyber assaults continue to pound the attack surface and then lateral pathways are exploited and used to spread further into organizations, leading to total compromise. You want to know where you’re vulnerable and how to fix it, and this is what vulnerability detection, vulnerability response, and vulnerability management tools are for.

Vulnerability detection is the identification of software vulnerabilities across your systems. It identifies what the weaknesses are in the environment. These might be detected via database scans, application scans, host-based scans, and other scans. Vulnerability detection is even more valuable from a security perspective when it is teamed with vulnerability response (that is, not just detection but remedial action).

Vulnerability response pulls vulnerable software assets aside and groups them for remediation. This is the crucial second half of overall vulnerability management, where that which is detected as a vulnerability or threat is dealt with.

Vulnerability management is the identification, analysis and treatment of security vulnerabilities in systems and software. It involves both vulnerability detection and response, as a one-two, or simultaneous, pair of punches.

Atomicorp solutions provide the vulnerability detection, vulnerability response, and vulnerability management organizations need to protect both their attack surface (all computing endpoints) and the invasion routes used to defeat organizations’ perimeters.

Vulnerability Detection and Management from Atomicorp

Vulnerability management requires strong continuous monitoring and remediation of security flaws, missing patches, misconfigurations and other means that attackers use to breach organizations. Modern vulnerability assessment requires near real time detection of vulnerabilities on all your endpoints, as opposed to old school, labor- and time-intensive network based scans that can take days or weeks to complete, and rely on all your assets, like laptops and mobile devices, to be accessible. Today’s vulnerability assessment requires full time access to every endpoint to ensure missing patches and misconfigurations don’t provide opportunities to breach your organization’s perimeter.

Lateral Movement

The top way that modern hackers compromise organizations is by finding a known vulnerability, and using that to gain access to a trusted network or environment. For most organizations, once you’re inside, you’re trusted. And this is how some of the biggest compromises occurred: through lateral movement. In the SolarWinds hack, hackers gained access to vulnerable internal systems, and from there were able to use admin access on those systems to gain control over systems that were NOT vulnerable. This one-two punch is how hacking really happens.

Malicious lateral movement spread into 18,000 organizations and government agencies as a result of the SolarWinds hack.

Vulnerability Management and Defense in Depth

When vulnerability management is combined with defense-in-depth (i.e., layered defense that places multiple successive physical or logical barriers in the path of the adversary), this provides the one-two punch to stop hackers. Once inside your network, adversaries need to be able to perform reconnaissance, move laterally, escalate privilege, access data, and exfiltrate assets. The more obstacles for them, the better your ability to stop the spread and damage.

Lateral defense-in-depth starts with zero trust, which means treating every asset as if it were the weakest link. This includes fixing known vulnerabilities quickly, eliminating vulnerable default settings, controlling remote access such as preventing Remote Desktop Protocol default settings from leading to the compromise of critical assets, preventing limitless Administrative shares, and protecting endpoints at the endpoint. Once modern hackers breach the perimeter, most organizations are doomed. They can easily perform reconnaissance, gain access to internal systems, and use this to spread malware or malicious activity with impunity.
Vulnerability management and intrusion and protection systems such Atomic OSSEC and Atomic Protector provide the vulnerability detection and management and lateral defense-in-depth you need against sophisticated attacks such as Dark Halo and Sunburst.

It’s detection across multiple operating systems, open source and Windows. Watch the video to see it in action.

Find out more about vulnerability detection, vulnerability response, and vulnerability management in Atomicorp’s intrusion detection and cloud workload protection systems.