Shutting Down Identity Attack Paths With Continuous Exposure Management

Hey everyone. Welcome back here to Techstrong TV. My next guest is Alex Gardner.

Alex is Director of Product Marketing over at XM Cyber, and it's his first time here on Techstrong TV, so let's welcome him. Hey, Alex. How you doing?

I'm doing great. Thanks for having me, Alan. My pleasure.

So Alex, we're going to talk about XM Cyber, and we're going to talk about some new functionality you guys have recently put out. But before we do that, I wanted to give the audience a sense of who they're listening to here. So why don't you share your story first, and then we'll hop to the other stuff.

Yeah, absolutely. So Alex Gardner, based in the UK. So I've been in cybersecurity now for about 11, 12 years.

I cut my teeth in kind of old school antivirus. So, my first company that I worked for was Sophos, where I was looking after the antivirus side of things, endpoint, EPP. Then I also worked with EDI and XDR as well, so expanding from proactive security into investigative as well.

So both elements there. I've also worked in the online fraud mitigation space as well, so things like helping to detect fraud in your online account. Has a bad actor compromised it?

Are they taking actions? Are they spending your money when obviously you don't want them to do that? And now I find myself here at XM Cyber.

Very cool. A lot of people in our audience probably are not familiar with XM Cyber. That's your job, right?

To make sure they do. But tell us- Yeah ... tell us the XM Cyber story.

Absolutely. So XM Cyber operates in the exposure management landscape. So, the short version is we help organizations to transform how they are approaching cyber risk in their environment.

So we do that by continuously validating their hybrid attack surface. So for example, we model how attackers are combining different types of exposures. So for example, misconfigurations in an active directory setup, vulnerabilities, CVEs, if they have any exposures such as identities with excessive permissions, or maybe we have compromised credentials within their environments, or AI exposures.

So we look at all of those holistically and validate if a bad actor could combine those in order to gain access to environments, move laterally within that environment, and then compromise business-critical assets. We're going to jump into our topic of discussion, but one last thing. Website, how do people contact XM Cyber?

What's kind of the on-ramp look like? Sure. com.

Then you can find all of the information around the exposure management platform. We also have dedicated sections, so if any of our listeners are particularly interested in identity security, for example, we have dedicated web pages in there where you can understand precisely how we will help identity security and IM teams. Alex, let's talk about recent announcements coming out of XM Cyber.

You guys have enhanced the product, some new features. Yeah. Give us the scoop on that.

Sure. So, we've announced recently two new capabilities for our platform. Basically, both of them revolving around excessive permissions.

So I'm sure most of our listeners will be familiar with the concept of least privilege access. So restricting the permissions that accounts have in order to reduce risk. So if one of those accounts, for example, were to be compromised, reducing the splash radius, the damage that it could inflict.

So only give access that is required for business to function in an optimal state. So the recent capabilities that we're going to be start rolling out over the next few weeks relate specifically to the cloud. So CIEM, I'm sure a lot of listeners will be familiar with cloud infrastructure entitlement management.

So looking at the entitlements across cloud estates, are these permissions being used? Are they excessive? Can I remediate them?

Can I take them away if they're not being used? And then the same for active directory entities as well. So there are kind of two key benefits here for teams responsible for identity security.

So the first of which is if you want to do preventative maintenance and identity security hygiene. So for example, a review of all of the permissions across your active directory, across your cloud environment. So look in there, see if there's anything that isn't being used, for example.

So for example, this tier one admin account, for example, the permissions haven't been used over the last 90 to 100 days. So that gives some confidence to the team that maybe it's safer to remove these rather than risk breaking a business process, for example, which may have been the case had you not been able to ascertain if those permissions were in use. The second key benefit there is tied in directly to some of our core functionality around attack paths themselves.

So in the example I gave you at the beginning where we're talking about what XM Cyber does as a whole. So there's validated attack paths. So let's take an example where as part of that attack path, we've identified that permissions are being leveraged by a threat actor to move laterally within your environment.

By adding in the actual usage of those permissions, excuse me, we're making it easier for security teams to make fast, decisive changes. So instead of having to go and check, are these permissions actively being used? Am I at risk of breaking a business process, introducing friction?

They can now see, okay-These permissions haven't been used for a certain amount of time. That gives me confidence to go to the team responsible for remediation, for example, and justify why these permissions should be removed, because they are introducing serious risk to a business-critical process, and they're not being used. Excellent.

I love it. One of the issues, look, everyone in security, we talk about mythos and the vulnerability apocalypse and all of this other stuff. But really- Yeah ...

when you get down to it, what we talk about there, Alex, is that security has to start working at AI scale. Right? The bad guys aren't sitting on their hands.

They're using AI. And the scale of potential attack with AI will overwhelm our normal defenses, which were kind of built around human scale, right? But now we've got to move to machine-scale remediation, machine-scale defense, machine-scale security.

Is this new feature set built for machine scale? I would say our entire platform is built for machine scale. So you're hitting on a really hot topic at the moment, which is AI-powered attackers.

So reducing the time for them to discover weaknesses in organizations- Sure ... attack surface, and reducing the time for them to exploit those weaknesses. So as you've correctly identified, it's the remit of the defenders to reduce the time to detect and reduce the time to remediate those potential gaps in their environment.

So this latest release, in combination with our entire platform, is essentially set up to help defensive teams do that. So one of the key challenges that we see when we're talking to customers and at industry events, for example, is prioritization. So alert fatigue is obviously not a new concept.

It's been around at least since I've been in cybersecurity, and I've spoken to true industry veterans, such as yourself or others who've been working in cybersecurity for much longer. Alert fatigue has always been a problem, and one of the benefits of exposure management is that it is helping you to prioritize what can wait until later and what absolutely has to be fixed now. So you was talking about CVEs and static scores.

That's not helpful for this AI era where we have to prioritize the most critical things first. So the XM Cyber approach is taking those examples we spoke about earlier, so misconfigurations, excessive permissions, vulnerabilities, et cetera, and then validating that they can actually be exploited. So a threat actor, if they were to penetrate your environment, they could leverage all of these things in order to reach critical assets.

So then you get a ready-to-go list of key priorities so you can respond preemptively. Well, respond isn't the right word. Preemptively reduce that risk, so you're kind of reducing that mean time to remediate.

Anything else we're missing in there, Alex? I would just say that the Exposure Management platform, specifically going back to the identity side of things, we're already offering some key benefits for identity security and IAM teams. So in addition to excessive permissions and excessive permissions usage, we also provide intelligence on cached, leaked, reused credentials, if your local or domain accounts have been exposed, or where those login details are reused, as well as helping to examine security posture of other third-party identity tools, such as IAM or PAM solutions.

So it really is a very holistic approach to identity security and security as a whole, which is the whole remit of exposure management. Love it. com?

That's right, yeah. So Alex, thanks for sharing all this with us today. Continued success over at XM Cyber, and come back and keep us posted on what's happening.

Sounds great. Thank you very much for your time, Alan. My pleasure.

Alex Gardner, Director of Product Marketing, XM Cyber, here on Techstrong TV. We're going to take a break. We'll be back.