Automated security validation and SASE: the perfect match to protect against cyberattacks
OP-ED · 22 MAY 2023
By Jérôme Beaufils · Lire en français
The complementarity between SASE (Secure Access Service Edge), as embodied by Cato Networks, and automated security validation, introduced by Pentera, is the perfect match to guard against cyberattacks.
When managers are asked about their cybersecurity concerns, the following worries come up frequently:
- What is my real exposure?
- Am I protected against the risk of a cyberattack?
- How can I guard against it and, if the worst happens, what can I do to limit the impact?
At a time when more than 60% of CISOs say they are prepared to pay a ransom in the event of an attack, and when cyber insurance is becoming ever more complex and expensive, these questions need to be approached pragmatically.
Knowing your exact risk exposure in order to protect yourself
Traditionally, measuring cyber risk meant investing in vulnerability scanning tools. These provide an exhaustive view of the known vulnerabilities present on information system assets.
However, the reports generated by these tools list hundreds or even thousands of CVEs to fix across the estate. The scale of the remediation task was enough to discourage IT teams, especially since fewer than 5% of them can actually be exploited by attackers.
Moreover, a vulnerability scanner only reports listed, static flaws. It does not take into account configuration errors, human mistakes, inadequate password policies or credential theft. These "dynamic" vulnerabilities, linked to the behaviour of users and administrators, are just as important. It is often the combination of static and dynamic vulnerabilities that lies behind the most successful attacks.
Organisations add a penetration testing policy to check their exposure. These campaigns, rarely run more than once or twice a year, have the following limitations:
- They cover a restricted scope: critical servers, a sample of user workstations and physical sites.
- Their results depend on the length of the test and, it must be said, on the skill and experience of the pen testers.
- Once the objective (the trophy) has been reached, other scenarios leading to less spectacular but equally dangerous results are rarely explored, mainly due to lack of time.
- The day after the pen test, the security posture may already be called into question because the information system has changed: new workstations, users, servers, applications or sites, the integration of a subsidiary, new vulnerabilities, and so on. The new exposure will only be known at the next pen test.
The combination of vulnerability scanning and manual pen testing is therefore insufficient to know, and so to protect, an organisation over time.
Validating your security posture automatically and continuously: the Pentera approach
To provide the most accurate real-time view of an organisation's security posture, Pentera introduced the concept of automated security validation, an innovative, simple and effective all-in-one alternative.
Based on a ready-to-use software platform, Pentera reveals the security posture of the information system:
- Automatically: through pen tests scheduled at regular intervals (monthly, weekly or even daily for the most critical resources).
- Holistically: all assets are taken into account, including workstations, servers, network and Wi-Fi equipment, and printers.
- Every path is explored: the full range of attack vectors, techniques and tactics is executed from the Pentera node against all internal resources. Just like a seasoned attacker, Pentera can launch relay attacks, escalate privileges and exploit static and dynamic flaws. Pentera also listens to local networks to capture sensitive traffic (usernames, passwords or hashes), which it then exploits during its attacks.
- Since these pen tests can last several days, Pentera can detect and exploit any one-off, isolated event, such as a contractor connecting remotely to a server with a weak password. It can also detect machines whose EDR or EPP protection is failing. These events fly under the radar of any other traditional analysis tool.
At the end, Pentera provides a simple, factual reading grid to understand:
- The results obtained, through clear and meaningful graphical kill chains explaining the sequence of actions that made the attack possible.
- The remediations to apply, contextualised and documented in an educational wiki interface. Because Pentera focuses on attacks that led to a result, the list of remediations usually does not exceed around twenty prioritised actions, easy to address as part of an internal action plan.
- A score assesses the security posture on day one. More than the score itself, what matters is how it evolves over time as the scenario is re-run.
Pentera also offers additional tools:
- Validating the information system's resilience against a ransomware attack (Maze, REvil, Conti or LockBit)
- Checking Active Directory password policies: password strength, age and reuse. Pentera shows that, on average, 10 to 25% of active AD account passwords can be cracked in under an hour.
- External security posture, based on domain and subdomain assets, public IP services and websites.
- Analysis of credentials leaked on the Internet, on social networks and on the Dark Web.
A CISO can easily map the actions performed by Pentera to the universal MITRE ATT&CK framework and challenge the effectiveness of protection tools (EDR, firewall, SIEM, SOC).
Finally, all the attacks carried out by Pentera are ethical (with no impact on production) but entirely real.
In the event of an attack: isolate and limit propagation with SASE and Cato Networks
Most attacks today rely on relay mechanisms or lateral movement, for example using the Microsoft SMB protocol. Simply by holding a user identity or hash, they can spread across the company's entire local or wide area network.
In a multi-site network (MPLS or IP-VPN), these attacks meet no obstacle, because internal devices face few or no constraints when communicating with their peers. Malware or a cryptolocker can thus spread step by step, even to remote sites or data centres, without any difficulty.
New SASE (Secure Access Service Edge) approaches, based on the principle of ZTNA (Zero Trust Network Access), bring this level of security inside the company itself:
- Only legitimate traffic between users, servers and sites is allowed. More than IP addresses, it is user identities that count (user awareness).
- Usually reserved for Internet access, anti-malware and IPS security mechanisms are also applied to internal sites, and even within a single site through inter-VLAN traffic.
An attack launched from a site's "guest Wi-Fi" VLAN will therefore be intercepted by the SASE security layer and cannot spread beyond that VLAN.
As the founding vendor of the SASE model, Cato Networks has implemented all these security mechanisms in its global backbone and its 90 points of presence (PoPs). These PoPs connect sites, data centres, mobile users and Cloud resources in an optimised and secure way. All traffic passing through the Cato Cloud undergoes firewall, IPS, anti-malware, CASB, DLP and RBI inspection.
Detecting and stopping threats drastically reduces the urgency of applying security patches and remediation actions. Cato Networks protection thus acts as a global shield securing all sites and internal resources.
These threats are all logged as events, which can be viewed in clear, concise dashboards. They are also mapped to the same MITRE ATT&CK framework so they can be correlated with other tools.
Measure, detect and prevent: the combined effectiveness of Pentera and Cato Networks
While they already make a lot of sense on their own, Pentera and Cato Networks complement each other effectively. Here are a few concrete examples:
- Any attack becomes visible to Cato as soon as it tries to move beyond its original VLAN. Intercepted by the local Cato gateway, the traffic is inspected at the Cato point of presence, analysed and blocked if an attack attempt is detected. These events can be paired with alerts to administrators.
- MITRE ATT&CK techniques and tactics can be correlated between Pentera and Cato Networks.
- Adopting Cato Networks can further accelerate the remediation plan proposed by Pentera, by isolating the riskiest legacy machines in dedicated VLANs.
- A resource accessible from outside (web server) is natively protected by Cato IPS and cannot be hit by attacks such as Log4j or its variants. Pentera can validate this through its external surface test.
Tailored implementation and managed services: the proximity of a specialist expert
SASETY, holding the highest certification levels from its partners Cato Networks and Pentera, supports its clients every day in implementing, adopting and operating these security technologies.
Deployment
- Full project management through to functional validation and the start of operations: project leadership, steering committees, risk management, acceptance testing and go-live validation
- Deployment of technical configurations: network and security, access, devices, directory integration, traffic optimisation, East-West and North-South security policy
- Deployment of automated security validation architectures, configuration of pen test scenarios, results analysis and recommendations
Managed services
- 24x7 monitoring and operation of transport and security infrastructure, change management
- Event reports, usage statistics, recommendations for future changes
- Regular internal and external pen tests
- Security posture validation: vulnerabilities, effectiveness of protections (IPS, AV, EDR) and of monitoring and response mechanisms (SIEM, SOC)
- Audit reports and associated recommendations
- Support for continuous improvement of the security posture
Thanks to its know-how and its ability to integrate complementary technologies, SASETY helps companies strengthen their security posture, prevent attacks and protect their IT assets in a pragmatic and effective way.
By combining Cato Networks and Pentera, SASETY offers a comprehensive approach covering secure connectivity, attack prevention and corrective measures.
SASETY's teams bring their expertise and experience in consulting, technology integration and managed services.
With SASETY, companies can take on IT security challenges with confidence and efficiency.
💡 To see how effective Cato Networks and Pentera really are, nothing beats a demo!
👀 To find out more about Cato Networks
👀 To find out more about Pentera
In the press
Actualités & Médias
