---

The reality for security teams is that you’re never done. Contrary to what vendors may want you to believe, implementing the latest, most advanced security control isn’t ever the end game. Fundamentally, teams need to do security control validation, and the sooner and more frequently, the better. Security control validation represents the discipline of ensuring that any controls in place are actually working as required. In this post, we’ll examine what security control validation is, why it’s so vital, and the key benefits organizations can realize from incorporating continuous security control validation into their overall strategy.

Introducing Security Control Validation

To combat the threats posed by cyber attackers, security teams in enterprises and government agencies have continued to implement and enhance a range of controls. However, even after massive investments have been made and tools have been deployed, the job is not done. It’s vital that teams validate their controls to optimize those security investments and ensure they’re providing the defenses required.

Background: Why Security Control Validation is Required

Over the years, there’s been continued evolution in security tools, the assets that need to be protected, and the threats that teams need to guard against. The number and type of security tools has continued to expand, but at a high level this diverse range of tools can be split into two categories: mechanisms that are intended to prevent attacks and those that are intended to detect and respond to attacks. Over time, the gap between these two approaches has only grown more pronounced. Fundamentally, that’s because teams have lacked a way to centrally and uniformly assess the performance of the controls in place. Further, while the focus for many organizations has been on prevention and detection tools, the reality is that threats and attacks continue to be missed, often to disastrous consequences.

For these reasons, security control validation has emerged as an urgent requirement. It is through security control validation that teams can begin to intelligently assess the controls in place, and mitigate the gaps left by threat prevention mechanisms. Ultimately, security control validation is instrumental in enabling teams to ensure they’re most fully leveraging their investments and mitigating risks.

Why Security Control Validation is Critical: Sample Scenarios

You may have deployed a handful or dozens of security controls. Are they working as intended and needed? Are they well-integrated? Are they continuing to deliver strong safeguards, even as the threat landscape and environment evolve? The following sections provide some examples of where and when security control validation can answer these critical questions.

Endpoint Security

Given the multi-layered, varied nature of today’s security environments, the number of tools employed on endpoints has continued to expand in recent years. Further, as new risks, technology environments, and security technologies emerge, tools continue to be added. Over time, this increasing number of security tools can be problematic. Ultimately, just because a tool has been implemented, doesn’t mean the endpoint is secure.

This is true for several key reasons:

• First, tools may not be foolproof, and they may not be up to date. For example, one study, which was based on data from more than 6 million devices, found that, at any given time, around 28% of devices had missing or outdated anti-virus or anti-malware protections.
• Second, the very complexity introduced by having many tools in place can lead to its own problems. Various tools can perform similar or overlapping functions. Different agents can be applied that may introduce conflicts or errors. This complexity can ultimately introduce failures and erode the very security benefits that tools were implemented to deliver.
• Third, even the best security controls may be misconfigured, introducing gaps and vulnerabilities.

Further, the proliferation of tools can have a direct and significant impact on users. Users may experience outages and degraded performance based on the tools implemented, not to mention being exposed to the possibility that their devices may be compromised by an attack.

Anti-Malware

Anti-malware solutions are another category that illustrate the criticality of security control validation. Today, it’s not uncommon for organizations to employ a combination of anti-malware solutions, including competing offerings. While internal staff may have some ideas as to which tool is working best, it can be very difficult to objectively assess these tools. For example, operators may get reports that indicate which threats were spotted, but not those that were missed.

Threat Assessment

No matter which or how many security tools have been employed, the reality is new threats arise all the time. In the wake of news about organizations being breached or high-profile vulnerabilities being discovered, teams can’t just assume they’re covered. They need to be able to ascertain whether they’re exposed, and, if so, where the gap is and how to address it. Teams need access to the latest threat methodologies so they can objectively and accurately assess the range of controls implemented and ensure they’re effectively blocking a specific vulnerability or method of attack.

Approaches for Validating Security Controls

Security teams can pursue a number of approaches for doing security control validation. Over the years, teams may have elected to do penetration testing, red team exercises, vulnerability scanning, and more. However, by and large, these approaches presented major limitations, requiring significant time and expense, while offering limited coverage.

How Breach and Attack Simulation Validates Your Controls

Breach and attack simulation offers a more efficient, programmatic way to conduct security control validation. As a result, it can help teams address their vital control validation objectives, while bypassing the limitations of manual, labor-intensive activities like penetration testing and red teaming.

Breach and attack simulation technologies build upon the talent and expertise of white hat hackers, security analysts, and other experts. These systems automate cyber attack simulation and cyber threat analysis techniques. Rather than relying on an individual or small team to do cyber threat analysis on an annual basis, these hacking simulators execute thousands of proven attack techniques at scale, continuously and automatically.

Security Control Validation: Solutions

Breach and attack simulation platforms enable teams to assess the efficacy of their entire security ecosystem, including the people, processes, and technologies in place. In addition, teams can validate specific controls, including data loss prevention (DLP) solutions, email controls, endpoint controls, network controls, SIEM controls, web controls and more. After validation, advanced breach and attack simulation technologies can generate a detailed remediation plan that helps teams maximize the efficacy of their controls.

By delivering these security control validation capabilities, advanced breach and attack simulation technologies can be employed in a number of ways:

• Conduct authoritative, fact-based solution evaluations. It is a challenge to evaluate and verify exactly how effectively a new tool will defend your enterprise against adversaries. With advanced breach and attack simulation technologies, you can quickly run thousands of attacks during the evaluation process to ensure you make the right investment.
• Assess hardened system images. After taking steps to harden a system image, you can execute attacks to quickly assess the efficacy of the changes—before rolling them into production. Assess system images on local, virtual, or cloud infrastructures, and get a detailed remediation plan.
• Conduct realistic attack scenarios for training. Take a mock scenario from theoretical to actual by executing attacks safely, and enabling teams to observe attacks and do incident response training.
• Safeguard remote workforces. Execute key attack methods to quickly identify and remediate security gaps, so you can safeguard the activities and data of your remote workforce.
• Hold security vendors accountable. Validate the controls in your entire security ecosystem to identify solutions that prevent and detect attacks, and those that completely miss them. Gain the power to hold your vendors accountable, leveraging insights and objective evidence in terms of how their solutions really perform under attack.
• Minimize endpoint tool bloat. Too often, PCs and laptops are overloaded with too many security tools, degrading system performance, the machine’s lifespan, and the user’s experience. Execute attacks on each security tool to identify the optimal combination of controls, so you defend your enterprise—without weighing down your devices.

Security Control Validation: Key Benefits

By employing advanced breach and attack simulation technologies, teams can realize a number of key benefits:

• Reduce risk. Identify vulnerabilities, gaps, and errors—before cyber attackers can exploit them. With breach and attack simulation platforms, teams can do continuous inspection to ensure that new risks, whether due to new attack techniques or new vulnerabilities that have emerged in the enterprise environment, are quickly identified and addressed.

• Strengthen security. Gain objective insights needed to identify the most critical threats, and take steps to address them.

• Enhance operational efficiency. Streamline administration and operations by knowledgeably identifying overlapping and ineffective tools, and eliminating them.

• Intelligently evaluate new controls. Accurately test prospective solutions, so you can determine which will work best in your environment, before you make the purchase.

• Maximize the return on existing investments. Objectively assess various tools in place and determine which are working and which aren’t. In this way, your teams can make the most of your existing controls and ensure these systems are optimized to deliver the highest levels of security.

Learn More

Learn more about the SafeBreach approach to security control validation.