Positive Security Indicator
In cybersecurity, a Positive Security Indicator (PSI) refers to a signal or metric that indicates a healthy, robust, and effective security posture. It's the opposite of a security alert or indicator of compromise (IOC), which signals potential threats or breaches.
Here's a more detailed breakdown:
Focus on Health and Resilience:
PSIs emphasize the proactive and preventative aspects of cybersecurity. They highlight actions and configurations that strengthen defenses rather than reacting to incidents.
They aim to ensure that security controls are functioning as intended.
Examples of PSIs:
Consistent and timely patch management: A high percentage of systems with up-to-date security patches.1
Regular security audits and assessments: Successful completion of scheduled vulnerability scans and penetration tests with minimal findings.
Substantial access control and authentication: High adoption rates of multi-factor authentication (MFA) and adherence to the principle of least privilege.
Practical security awareness training: High participation rates and demonstrated knowledge among employees.
Robust backup and recovery systems: Regular and successful data backups with verified recovery procedures.2
Up-to-date firewalls and intrusion detection/prevention systems: Confirmation that those systems are running and that their definitions are current.
Encryption usage: Confirmation that sensitive data is encrypted, both in transit and at rest.
Low user security-related errors: Decreased phishing emails clicked or other security-related mistakes.
Importance of PSIs:
Proactive security posture: PSIs enable organizations to proactively identify and address potential weaknesses before they can be exploited.3
Improved risk management: By monitoring PSIs, organizations can better understand their overall security risk and make informed decisions about resource allocation.
Enhanced compliance: PSIs can help organizations demonstrate compliance with industry regulations and standards.
Increased confidence: PSIs provide stakeholders with confidence that security measures are effective.
Distinction from IOCs:
While IOCs signal potential threats, PSIs assure security effectiveness.
IOCs are reactive, while PSIs are proactive.4
IOCs are signals of bad events, while PSIs are signals of sound events.
PSIs provide a way to measure and demonstrate the effectiveness of cybersecurity efforts, contributing to a more secure and resilient organization.
Here’s how ThreatNG enhances cybersecurity:
External Discovery: A Robust Starting Point
ThreatNG's external discovery is a powerful asset because it operates without needing any connectors. This means it gathers information from an attacker's viewpoint, accurately representing your attack surface. This capability is crucial for identifying potential entry points that internal scans might miss.
External Assessment: Deep Dive into Vulnerabilities
ThreatNG doesn't just scratch the surface; it offers in-depth external assessments with a variety of ratings:
Web Application Hijack Susceptibility: ThreatNG meticulously analyzes externally accessible parts of web applications, using external attack surface and digital risk intelligence, including Domain Intelligence, to pinpoint vulnerabilities. For example, it can identify unprotected admin panels or outdated software versions that could be exploited.
Subdomain Takeover Susceptibility: ThreatNG assesses the risk of subdomain takeovers by examining subdomains, DNS records, and SSL certificate statuses. Imagine ThreatNG flagging a forgotten subdomain with an expired certificate, a prime target for attackers to hijack and use for phishing campaigns.
BEC & Phishing Susceptibility: ThreatNG's assessment incorporates sentiment, financials, Domain Intelligence (including DNS permutations and Web3 domains), Email Intelligence, and Dark Web Presence (Compromised Credentials) to gauge susceptibility to Business Email Compromise (BEC) and phishing attacks. For instance, it can detect lookalike domains that could be used in phishing attacks or compromised credentials that could enable BEC.
Brand Damage Susceptibility: ThreatNG evaluates the potential for brand damage using attack surface intelligence, digital risk intelligence, ESG violations, sentiment and financials (like lawsuits and negative news), and Domain Intelligence. An example would be ThreatNG identifying negative social media sentiment coupled with the availability of lookalike domains, indicating a high risk of a brand impersonation campaign.
Data Leak Susceptibility: This assessment uses external attack surface and digital risk intelligence, focusing on Cloud and SaaS Exposure, Dark Web Presence, Domain Intelligence, and Sentiment and Financials. ThreatNG might discover exposed cloud storage buckets or compromised credentials that could lead to sensitive data leaks.
Cyber Risk Exposure: ThreatNG's Domain Intelligence module analyzes certificates, subdomain headers, vulnerabilities, and sensitive ports to determine cyber risk exposure. It also factors in Code Secret Exposure by discovering code repositories and their exposure level, investigating for sensitive data. Cloud and SaaS Exposure and compromised credentials on the dark web are evaluated. For example, ThreatNG could reveal an exposed Git repository containing API keys or a server with an open, vulnerable port.
ESG Exposure: ThreatNG rates an organization based on discovered environmental, social, and governance (ESG) violations through external attack surface and digital risk intelligence. It analyzes offenses such as competition, consumer issues, employment practices, and environmental incidents.
Supply Chain & Third-Party Exposure: ThreatNG derives this from Domain Intelligence (enumerating vendor technologies), Technology Stack analysis, and Cloud and SaaS Exposure. It could identify a third-party vendor with known vulnerabilities in their technology stack, posing a risk to the organization.
Breach & Ransomware Susceptibility: This is calculated from external attack surface and digital risk intelligence, including domain intelligence, dark web presence (compromised credentials and ransomware activity), and sentiment and financials (SEC Form 8-Ks). ThreatNG might detect discussions of a ransomware gang targeting a specific industry coupled with exposed sensitive ports, indicating a heightened risk.
Mobile App Exposure: ThreatNG evaluates an organization’s mobile app exposure by discovering them in marketplaces and analyzing them for sensitive information like access credentials, security credentials, and platform-specific identifiers. For example, it can find hardcoded API keys or exposed cloud storage buckets within a mobile app.
Positive Security Indicators: Importantly, ThreatNG also identifies and highlights an organization's security strengths. Instead of solely focusing on negatives, it detects beneficial security controls like Web Application Firewalls or multi-factor authentication, validating their effectiveness from an external perspective. This provides a balanced view of the security posture and explains the benefits of these positive measures.
Reporting: Clear and Actionable Insights
ThreatNG delivers various reports, including executive summaries, technical details, prioritized findings, security ratings, inventory reports, ransomware susceptibility assessments, and U.S. SEC filing analysis. This comprehensive reporting ensures that all stakeholders receive the information they need in a format that's easy to understand and act upon.
Continuous Monitoring: Staying Ahead of Threats
ThreatNG continuously monitors the external attack surface, digital risk, and security ratings. This proactive approach enables organizations to stay ahead of emerging threats and detect changes in their security posture in real time.
Investigation Modules: Deep Dive into Findings
ThreatNG's investigation modules provide potent tools for in-depth analysis:
Domain Intelligence: This module offers a wealth of information, including:
Domain Overview with a Digital Presence Word Cloud and enumeration of bug bounty programs.
DNS Intelligence with record analysis, domain name permutations, and Web3 domain analysis.
Email Intelligence for security presence and format predictions.
WHOIS Intelligence and analysis of other domains owned.
Subdomain Intelligence, providing HTTP responses, header analysis, server headers, cloud hosting details, e-commerce platforms, content management systems, and much more. It also assesses subdomain takeover susceptibility, identifies content, and analyzes ports and known vulnerabilities.
IP Intelligence, Certificate Intelligence, and Social Media analysis.
Sensitive Code Exposure: This module discovers public code repositories and uncovers risks like exposed access credentials, security credentials, and configuration files. For example, it can identify a repository with exposed AWS credentials or database connection strings.
Mobile Application Discovery: ThreatNG discovers mobile apps in various marketplaces and analyzes their contents for sensitive information.
Search Engine Exploitation: This module helps users investigate an organization’s susceptibility to information exposure via search engines, including website control files and search engine attack surface analysis.
Cloud and SaaS Exposure: ThreatNG identifies sanctioned and unsanctioned cloud services, cloud service impersonations, exposed cloud buckets, and SaaS implementations.
Online Sharing Exposure: This module detects organizational presence within online code-sharing platforms.
Sentiment and Financials: ThreatNG analyzes organizational lawsuits, layoff chatter, SEC filings, and ESG violations.
Archived Web Pages: It retrieves archived web pages to uncover past exposures.
Dark Web Presence: This module monitors for organizational mentions, ransomware events, and compromised credentials on the dark web.
Technology Stack: ThreatNG identifies the technologies used by the organization.
Intelligence Repositories: A Wealth of Context
ThreatNG's intelligence repositories provide valuable context for investigations, including data on the dark web, compromised credentials, ransomware events and groups, known vulnerabilities, ESG violations, bug bounty programs, SEC Form 8-Ks, Bank Identification Numbers, and Mobile Apps.
Working with Complementary Solutions
While the document doesn't explicitly detail ThreatNG's integrations, its comprehensive external view and detailed findings would make it a valuable complement to various security solutions:
SIEM (Security Information and Event Management): ThreatNG's external threat intelligence could enrich SIEM alerts, providing context and improving threat detection.
SOAR (Security Orchestration, Automation and Response): ThreatNG's findings could trigger automated responses in SOAR platforms, such as isolating a vulnerable server or notifying security teams.
Vulnerability Management: ThreatNG's external vulnerability assessments could supplement internal scans, providing a more complete picture of an organization's risk.
ThreatNG is a robust platform that enhances cybersecurity by providing comprehensive external discovery and assessment, detailed reporting, continuous monitoring, and in-depth investigation capabilities. Its intelligence repositories and ability to identify positive security indicators further strengthen its value.
