Check what is exposed,
and review updates and settings.
Review unnecessary exposure, outdated software, and configuration gaps.
Prioritize the problems you find, assign people to remediate them, and check the results afterward.
Turn “we are fine”
into a check.
Having had no incidents so far is not the same as having confirmed your current state. First, look at the actual state: are there environments left by a predecessor, or updates that were put off?
How environments slip out of managementStart by reviewing
states like these.
Select an item to see how to read the problem, how to remediate it, and how to check it. For anything that is hard to judge in-house, check together with your administrators or maintenance provider.
Do not leave unneeded environments exposed.
When old test sites or unneeded services are left exposed, they tend to slip out of management and updates.
Confirm their purpose and administrator, and if they are not needed, consider retiring them or taking them offline. For environments you need, also review the scope from which they can be connected to.
Check the exposure of the target hosts and services in the observation results after the change.
The diagrams are illustrative examples for thinking about countermeasures. The order shown does not indicate remediation priority.
Decide the order by impact,
not by the order things were found.
It is hard to fix everything at once. In addition to how dangerous the problem itself is,
judge it together with the state of exploitation and the impact on your business.
What damage could it lead to?
Check the nature of the problem, such as information leaks, abuse of privileges, or service outages.
Is it actually being exploited?
Check information that it is being used in attacks and how easy it is to exploit.
What in your business does it affect?
Check which operations, customers, and data the environment relates to.
An outage directly affects sales and service to customers. Think about how to remediate while keeping the business impact down.
Even if it is rarely used, it can be an entry point if it is exposed. Consider whether it needs to stay at all.
An example of how to think about the decision. Priorities are decided taking into account exposure and connections with other assets.
Assign owners and
check through to the results.
Even when you know what needs to be done, problems remain if it is unclear who will move it forward. Share the target, remediation method, and timing internally and with your maintenance provider, and check progress.
In PentaTrail CTEM, you can divide assets into groups and set an owner and members. The actual fixes are done by the people responsible or your maintenance provider, and after remediation the state is checked in the observation results.
So that an assessment does not end with a reportPentaTrail CTEM: sharing areas of responsibility and checking after remediation
A diagram of how remediation moves forward. It does not show product screens or the progress of work tickets.
The first step is
checking your internet-facing assets.
Starting from your domain, check what is visible from outside.