Tenable aims to unify your cyber security with a risk management platform


Tenable today announced the general availability of Tenable One, a unified exposure management platform designed to meet the evolving needs of modern cybersecurity professionals by providing a holistic view of both on-premises and cloud-based attack surfaces offers.

The modern cybersecurity attack surface is complex, rapidly changing, and encompasses a variety of different target systems and users, all interconnected in various ways. Modern cybersecurity defenses, on the other hand, are all too often designed in the same way as in the past, leading to major threat mitigation challenges, according to a Tenable whitepaper released alongside its new product.

The idea behind Tenable One is simple – it’s a cloud-based system that pulls in data from different types of systems that track an organization’s digital assets and identify vulnerabilities, giving cybersecurity professionals a much clearer picture of their own exposure to cyber threats Cloud versions of the company’s existing web app scanning, cloud analytics suite and Active Directory protection.

In addition, the system provides options to visualize security risks, applies predictive analytics to identify potential areas of risk, and analyzes attack paths through various assets in an organization.

The exposure management platform aggregates security data

The product has three core functions. First, the Lumin Exposure View, which aggregates data from the company’s aforementioned security products to provide an overview of an organization’s overall vulnerability score, presented as a “cyber exposure” number. Second, attack path analysis uses analytics to map vulnerabilities in a system or application to the rest of the system, giving organizations insight into what exactly is vulnerable when a specific vulnerability is exploited on their systems. Finally, the company’s External Attack Surface Management program analyzes metadata about all of an organization’s internet-connected assets — including inventorying devices that a security team may have overlooked — to provide greater insight into risk posture.

At launch, the company said Tenable One will only aggregate data from its own security products, but plans to add more data collection options for other companies’ products. It’s sold through resellers like IBM, Verizon, and CDW, and caters to the number of assets and apps a particular company wants to manage.

Everything from web applications and identity management systems to cloud assets is under threat, but each of these systems generally requires its own dedicated security framework to keep it secure. That complicates the cybersecurity professional’s job tremendously, according to Tenable, which in its white paper identifies three key concerns security teams need to address.

First, Tenable wrote, security programs are generally reactive, while they would be much more effective if they were proactive. The ability of active measures to protect an organization’s IT infrastructure—which include mapping the connections between users and systems, proactively searching for potential vulnerabilities, and optimizing privileges—to protect an organization’s IT infrastructure is often accompanied by an overemphasis the reactive hinders side of the equation. (SOC analysis, incident responders, and the like fall into this category.)

Second, the type of cybersecurity applications, which are typically designed to address a specific security issue, limits their effectiveness, according to the report.

“From an organizational structure standpoint, there are many valid reasons for siloing security programs,” said Tenable. “But a security program based on a hodgepodge of technologies, each performing a tailored function, makes it virtually impossible for security teams to reduce risk.”

After all, all of these technologies generate information and create a cascade of data that can be unwieldy – or even impossible – to work with. The report’s authors said that security teams too often limit themselves to “putting the data in spreadsheets,” which just isn’t good enough for the job.

The standard version of Tenable One includes the company’s .io cloud analytics suite, web app scanning, cloud security status monitoring, Active Directory security, and Lumin’s exposure view. The Enterprise version relies on the attack path analysis function and functions for managing external attack surfaces. The default version replaces Tenable.ep for all customers who are auto-enrolled.

Copyright © 2022 IDG Communications, Inc.


Comments are closed.