Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

You Can’t Defend IT Hidden in the Shadows

You can’t secure and protect devices or data you aren’t even aware of. It’s a simple premise, but one that has become more and more relevant in recent years. It’s challenging enough to just keep up with identifying, managing, and resolving the vulnerabilities you know about, but it’s crucial to be able to detect and identify those unknown and shadow IT assets as well.

You can’t secure and protect devices or data you aren’t even aware of

The explosion of mobile devices, cloud services, and virtualization tools make it very easy for employees to connect to and use unauthorized technologies that IT is not aware of. All of your effort to manage vulnerabilities and protect the network can be undone by one attacker exploiting a vulnerability on an unknown device or service connected to your network. When users introduce technologies and applications without IT consent, they expose the company to unnecessary risk and handicap IT’s ability to effectively protect the network.

Lurking in the shadows

You can’t be confident in your security posture if you can’t be sure you’re identifying and remediating vulnerabilities in all of the devices and applications on your network. You might achieve some false sense of security by checking a box for resolving the vulnerabilities you’re aware of, but shadow IT can still leave you weak and defenseless.

Unknown mobile devices on your network expose you to significant risk. A report from the end of 2015 found that an average mobile app has nine vulnerabilities—and more than a third of those are critical or high vulnerabilities. The report revealed that more than a quarter of the mobile app vulnerabilities result in personal or sensitive information leakage, and nearly a quarter are related to authentication and authorization.

An average mobile app has nine vulnerabilities

Another place where risk lurks in the shadows is with cloud services and virtualization. Users just sign up for services like Dropbox or an unsanctioned CRM tool, and with the push of a button your network and data are exposed to vulnerabilities you don’t know about. Cloud providers average 18 vulnerabilities per asset. It takes on average 103 days for a typical organization to remediate a security vulnerability. Cloud providers are faster than many other industries when it comes to addressing vulnerabilities, but whether it’s 30 days or 300 days you can’t address or mitigate the risk because you don’t even know you’re exposed.

Turn on the lights

There’s a Chinese proverb that goes, “Better to light a candle than to curse the darkness.” You don’t need to fear unknown and shadow IT. You just need to accept that it exists and have the right tools in place to deal with it.

The traditional approach to vulnerability management isn’t good enough. Conducting periodic scans only provides a snapshot in time. The scan may not identify new or unknown assets. Even if it does, it will miss devices and services that are not connected or enabled at the time of the scan, leaving you exposed again until the next periodic scan.

Conducting periodic scans only provides a snapshot in time

Tenable SecurityCenter Continuous View™ (CV) provides comprehensive visibility of all assets on your network. SecurityCenter CV™ enables you to detect and identify transient laptops, personal mobile devices, and rogue cloud applications. It combines active and passive monitoring tools to detect unknown devices and applications, and identify associated vulnerabilities so that shadow IT doesn’t expose you to unknown risk.

Unknown assets and shadow IT are part of today’s IT reality. You need to make sure you have policies and tools in place to ensure you have complete visibility combined with relevant context so you can take decisive action to protect your network and data.

For more information, read about Tenable’s Unknown and Shadow Assets solution. And watch the Tenable Blog this month for more articles about Shadow IT.

Related Articles

Cybersecurity News You Can Use

Enter your email and never miss timely alerts and security guidance from the experts at Tenable.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin and Tenable Web App Scanning.

Tenable Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

100 assets

Choose Your Subscription Option:

Buy Now

Try Tenable Web App Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management and Tenable Lumin.

Buy Tenable Web App Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable Lumin

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management and Tenable Web App Scanning.

Buy Tenable Lumin

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable Nessus Professional Free

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

NEW - Tenable Nessus Expert
Now Available

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. Click here to Try Nessus Expert.

Fill out the form below to continue with a Nessus Pro Trial.

Buy Tenable Nessus Professional

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Try Tenable Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Tenable Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Tenable Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save more.

Add Support and Training