In the ever-evolving landscape of cybersecurity, the story of Lumen Technologies' journey to rebuild exposure management at scale is a fascinating one. It serves as a stark reminder of the challenges enterprises face when it comes to asset management and the potential consequences of inaccurate data.
The Problem with Asset Inventories
Most organizations, including Lumen, often assume their asset inventories are reasonably accurate. However, the reality is quite different. According to a survey, only 45% of organizations consolidate their asset data effectively, and this lack of consolidation can have a ripple effect on downstream security programs.
Lumen, with its nearly century-old history, decided to challenge this assumption. Geoff Krahn, the Director of Product and Platform Security at Lumen, and his team embarked on a mission to reconcile data from over 40 disparate systems using the Axonius asset intelligence platform. What they discovered was eye-opening.
Uncovering the Truth
Initially, Lumen's known cyber assets numbered around 17,000. However, after the initial reconciliation process, they identified a staggering 500,000 devices, and this number has since grown to approximately 1.1 million. This revelation highlights a critical issue: the potential for a significant gap between perceived and actual asset inventories.
"It has really been an eye-opener for the organization as a whole," Krahn said. "Being able to quantify our responsibilities and highlight control gaps has been instrumental in gaining leadership support and funding."
The Power of Trusted Asset Data
With a more accurate asset inventory, Lumen was able to enhance its exposure management program. One of the key benefits was the ability to respond swiftly to zero-day vulnerabilities. Krahn's team could now identify affected systems, confirm external exposure, and establish ownership within minutes, a process that was previously mired in uncertainty.
Additionally, Lumen developed an Application Posture Dashboard, which evaluates risk at the application level rather than just the infrastructure level. This dashboard correlates CMDB relationships, control coverage, vulnerability data, and end-of-life status, providing a more holistic view of potential risks.
Moving Beyond 'Scan and Spam'
The old model of vulnerability management, often referred to as 'scan and spam,' is inefficient and ineffective. Most teams default to sorting by CVSS score, which, while important, fails to consider exploitability, blast radius, and business impact. This approach often buries critical issues under a mountain of medium-severity findings.
Lumen, with its improved asset data, took a different approach. By combining technical findings with asset context, business criticality, and control coverage, the team was able to prioritize remediations that deliver the greatest risk reduction. This risk-based exposure management approach is a significant step forward in cybersecurity.
The Impact of Trusted Data
The shift to trusted, quantified visibility had a profound impact on Lumen's leadership. It led to significant decisions, including a cloud migration strategy and a tenfold increase in security investment. The board now relies on Axonius-generated reports for asset coverage, EDR deployment, and compliance insights.
"The visibility Axonius provided directly contributed to our decision to migrate the majority of our infrastructure to the cloud, reducing overall risk by 40%," Krahn said.
A Wake-Up Call for Enterprises
Lumen's experience serves as a wake-up call for enterprises. If an organization with dedicated security leadership and advanced inventory systems can uncover such significant gaps, it's safe to assume that most enterprises are operating with similar inaccuracies. Every exposure management program is only as good as the asset data it's built upon, and if that foundation is untested, the entire system is built on assumptions rather than evidence.
In my opinion, this story highlights the importance of continuous improvement and the need for organizations to regularly challenge their assumptions and data. It's a reminder that in the world of cybersecurity, accurate information is the foundation upon which effective strategies are built.
