Why Cyber Assets are the Future of Cybersecurity

In 2020, as we round out what has turned out to be a terrible start to the new decade, cyberattacks and breaches continue trending up. Threats are growing faster than companies can identify them. According to Verizon's 2020 Data Breach Investigations Report, in 2019 there were nearly 32,000 security incidents and 4,000 data breaches. What's worse, on average, it takes companies 280 days to identify and contain a data breach. This is simply too little, too late.

Why do breaches keep happening?

Unfortunately, security vendors love to sell a bunch of specialized tools to companies to solve segmented security problems. Customers are being inundated with tools for every possible niche and sub-niche in security tech. Your firewalls aren't good enough at blocking malicious traffic? Great, we've got the latest in next-gen web application firewall for you. Do you have an unmanaged corporate device? Here's yet another specialized endpoint security and mobile device management (MDM) solution. Need help with cloud security and compliance?  'Cloud Native' security tools will help you gain  'full visibility' into your cloud workloads. As the number of tools keeps piling up, so does the cost of executing this defense-in-depth model.  It's gotten so bad that we should probably be calling it "expense in depth" instead.

Here's an illustration of the problem.
Source: Optiv

Here's the issue  – we've created a whole host of specialized security tools that don't work together to address the fundamental problem: how do I keep my entire organization secure in a programmatic and scalable way?

Most of the security tools that we see in the market today are completely siloed and geared toward niche audiences and specific use cases. So instead of providing users with usable and simple security, we've actually added to the problem by increasing complexity. Simply put, complexity is what has stopped security teams from achieving:

• Continuous security and compliance.
• Real visibility into cyber assets, security data, and compliance drift.
• Quick and effective incident discovery and response.
• Best of breed cybersecurity hygiene and shared responsibilities models.

Why Cyber Asset Security and Governance Matters

Cybersecurity is all about cyber assets. When companies are hacked, it is through their cyber assets  – be it through their networks, hardware, and software  – they are all potential points of entry for attackers. Our "cyber asset" universe continues to expand as we continue to progress with cloud and digital transformation to keep our businesses moving faster. 

If you ask your team (cloud, security, engineering, etc.) how many cyber assets are in our environment or how many cyber assets do we manage today, you'll get different answers depending on who you ask. Companies have no real idea of what cyber assets are in their environment — and more importantly, how they connect and interact with each other. 

In a typical company, this means that you likely have tens of thousands (if not hundreds of thousands) of cyber assets in your environment that you need to effectively secure. How do you secure them without understanding and actually being able to visualize and comprehend the relationships between these assets?  Here are some hard truths about the current state of cybersecurity asset management:

• No singular team owns or manages the IT assets. With the adoption of cloud and digital environments, we've moved to a more open and decentralized way of working. There is no longer a central group that has a complete view into the entire security and infrastructure asset and relationship landscape.
• No solution sees the big picture. All security tools are collecting the information you need but they're not connected, and they're not speaking to one another and they don't have a view into how your assets interoperate. It's not just the assets themselves, it's also the relationships between assets that matters. Without the relationships you lose approximately two-thirds of the insights your security and infrastructure tooling can provide.

All of this means that we need to fundamentally reinvent how we track, monitor, and govern the new "cyber asset" universe.

A New Market Opportunity in Security

At JupiterOne, we want all of your teams (Security, DevOps, Compliance, IT, etc) to have complete and continuous visibility and in-depth understanding of every relationship surrounding  your critical cyber assets. This includes:

• Infrastructure (e.g. resources and configuration within your AWS/GCP/Azure account)
• Development (e.g. source code repos, commits, access rights, code reviews, scanner findings)
• End users (e.g. devices, what trainings they've received, unknown endpoints)
• Applications (e.g. workload details, access controls, storage buckets, encryption)
• Security controls and findings (e.g. IAM tools, security scanners, security agents  – servers and endpoint agents).
• Ephemeral devices (e.g. containers, VMs)
• And much much more.

At JupiterOne, we are confident that a more thoughtful and data-driven approach to your security program and tooling will reduce security complexity. With this approach in mind, we're getting to the root of the problem by connecting all of your aggregate security and infrastructure cyber assets. Our goal is to provide you with cyber asset visibility, security, compliance and governance no matter where your cyber assets reside, no matter what your technology stack looks like, and no matter what your current program maturity is.

JupiterOne solves the biggest technology opportunity in security today: J1 is the number one aggregator of cyber assets and cyber asset relationships on the planet.

I've spent the last decade or more thinking about how complex our systems and tools have become. Most of this complexity is a result of a reactive mindset to the changing threat landscape and the ad hoc nature in which security tech is typically adopted in companies. It gives businesses the illusion of security  – at a huge cost. This is one of the fundamental problems that JupiterOne solves.