Page 31 - Cyber Defense eMagazine August 2024

technologies the alerts were required to traverse. This created a critical time gap that real malicious actors
could have exploited.

Given these revelations, the organization has made critical adjustments to its alert pipeline and now plans
to expand the scope of these BAS-enabled health checks beyond endpoint alerts to cover a broader
range of event types, such as web application firewall and email scenarios.

Such improvements begin with providing SOC teams with a clear understanding of how security controls
detect, prevent, and mitigate attacks across the entire cyber kill chain. Teams should be able to leverage
the MITRE ATT&CK framework to understand overall organizational risk exposure, and even visualize
attack paths and explore alternative mitigation approaches. Such incident response plans have and will
continue to become more relevant in the regulatory regimes and cyber insurance audits in the years to
come.

Plan, measure & report progress.

BAS platforms can enhance visibility when they incorporate customizable dashboards and reports to help
stakeholders quickly understand existing security gaps, evaluate risks, and recognize security drift.
Reports can also provide important security posture assessments that allow CISOs to measure their
baseline, track improvement over time, and align security program reporting, KPIs, and investments with
business goals.

These priorities require BAS platforms that are able to identify risk exposure with security scores,
establish benchmarks against which improvement is measured, and help effectively communicate
progress over time through personalized reports that define investment priorities.

Benchmarking, specifically, can be particularly useful where it allows organizations to compare their
security posture to that of similar organizations within their industry. When given access to this type of
information, organizations can evaluate their performance across different security control categories via
side-by-side comparisons of blocked percentage scores and proactively identify areas for improvement
to bring them more in line with industry standard performance. By communicating score differences
compared to peers, key stakeholders are better able to make informed decisions about which cyber
defenses must be prioritized for focus and investment.

Recover quickly with confidence.

Finally, if an attack does occur, BAS frameworks can assist organizations not only in reporting the details
of the incident, but they can also be transformative in identifying weaknesses that may have contributed,
providing remediation advice, and retesting the resilience of the environment to ensure any gaps are
closed.

Cyber Defense eMagazine – August 2024 Edition 31
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.