Many organisations struggle to quantify the full extent of their threat landscape and attack surface. This is compounded by issues surrounding vulnerability prioritisation, which has become a problem. It causes headaches due to several factors such as cost, disruption, and time. Organisations, therefore, need to start adopting a risk-based approach to influence where effort should be invested to reduce the attack surface and the risk posed to the organisation.
Organisations need to start asking themselves what might happen if an asset were to be compromised: what information does that asset hold and what problems could that cause to the organisation if it was suddenly unavailable (or worse stolen) and in someone else’s hands? This approach helps with the plight of remediation, but it’s not enough.