Risky Bulletin Episode Summary: "Sponsored: Nucleus Security on Asset Correlation and Asset Linking"

Release Date: February 23, 2025
Host: Kathleen Campano (A)
Guest: Aaron Atarzadech, Enterprise Security Engineer at Nucleus Security (B)

1. Introduction to the Interview

In this episode of Risky Bulletin, hosted by Kathleen Campano, the spotlight is on Asset Correlation and Asset Linking within the realm of vulnerability management. The discussion is enriched by insights from Aaron Atarzadech, an Enterprise Security Engineer at Nucleus Security. Aaron brings a wealth of knowledge on how modern vulnerability management transcends traditional methods, emphasizing the significance of comprehensive data utilization.

[00:00] A: "This is a Risky Business News sponsor interview with Aaron Atarzadech, Enterprise Security engineer at Nucleus Security. Welcome, Aaron."

[00:14] B: "Thank you so much for having me."

2. The Challenge in Vulnerability Management

Kathleen initiates the conversation by addressing the skepticism vulnerability management companies often face. She highlights the common perception that vulnerability management is limited to fixed data points derived from CVEs (Common Vulnerabilities and Exposures), with some believing that simple scripts can suffice.

[00:16] A: "Vulnerability management companies have always had an image problem in the eyes of customers... customers have way more data at their disposal than they think they have."

Aaron counters this by explaining that many vulnerability management teams rely solely on scanners, neglecting other critical data sources.

[00:55] B: "Most vulnerability management teams... are looking at just their scanners that scan the infrastructure... there's often endpoint agents... infrastructure teams managing VMs or EKS clusters."

3. The Explosion of Data with Cloud Adoption

The shift to cloud environments has exponentially increased the volume and variety of data that needs to be managed. Aaron attributes this transformation to the mass adoption of cloud services and the impact of the COVID-19 pandemic, which accelerated remote operations and cloud migrations.

[01:51] B: "Mass adoption of cloud environments... Covid played a big role... supporting not just one VM, but multiple assets surrounding each host... an explosion of data now."

He elaborates on the complexity introduced by cloud infrastructures, where a single virtual machine (VM) is interconnected with various components like VPCs, security groups, IAM roles, and storage volumes.

4. Nucleus Security's Approach to Data Collection

Kathleen probes into how Nucleus Security manages to harness such vast amounts of metadata. Aaron emphasizes the importance of integrating multiple data sources to achieve a holistic view of the organization's assets.

[02:34] B: "We are big proponents of plugging into everything... underlying cloud environments like AWS, GCP, and Azure... EDR solutions, CMDBs, application teams' spreadsheets... aggregating data that was previously siloed."

This comprehensive approach ensures that vulnerability management is not confined to isolated scanners but encompasses a wide array of organizational data points.

5. Real-time Syncing and Asset Management

As organizations continually evolve, so do their assets. Kathleen raises concerns about the dynamic nature of cloud infrastructures and the challenge of maintaining up-to-date dashboards.

[05:20] B: "We do real-time syncing with the cloud... setting up mapping rules or automation rules... continuously triggered with every new event or asset."

Aaron underscores the necessity of real-time data synchronization to prevent redundant efforts in vulnerability remediation, especially in environments with rapidly changing assets like container clusters.

6. Prioritizing Vulnerabilities through Asset Context

One of the pivotal topics discussed is the prioritization of vulnerabilities based on the context of the assets they reside in. Aaron explains how Nucleus Security differentiates risks not just by the vulnerabilities themselves but also by the asset characteristics.

[06:47] B: "It's not just the vulnerability context, it's the asset context... an EOL asset with a vulnerability is higher risk than a fully supported asset with the same vulnerability."

By correlating data from various sources, Nucleus Security dynamically adjusts the prioritization of vulnerabilities, ensuring that those posing the greatest risk receive immediate attention.

7. Use Cases Highlighting Asset Correlation

Aaron provides concrete examples to illustrate the power of asset correlation:

• End-of-Life (EOL) Assets: Vulnerabilities on EOL assets are given higher priority because these assets cannot be patched, increasing their exploitability.

  [07:15] B: "A vulnerability on an EOL asset will dynamically be adjusted and bumped up to the very top of the list."

• Sensitive Data Handling: Integrating data from Data Loss Prevention (DLP) solutions like Rubrik allows prioritization of vulnerabilities on hosts storing sensitive information (e.g., credit card data, social security numbers).

  [08:44] B: "Correlating DLP solutions... prioritize vulnerabilities on hosts with sensitive data higher than those without."

These scenarios demonstrate how multi-faceted data integration leads to more informed and effective vulnerability management.

8. Asset Linking in Application Security

The discussion transitions to Asset Linking, a strategy crucial for maintaining coherence in large teams and complex infrastructures. Asset linking involves tracing vulnerabilities from their runtime environment back to their source in the development pipeline.

[09:38] B: "Correlate runtime environments back to REST environments... pinpoint where a vulnerability surfaced from runtime back to the repository."

In application security (AppSec), this is particularly beneficial. Aaron describes how correlating cloud account information with vulnerability data enables prioritization based on the environment's criticality.

[10:56] B: "Mapping Cloud account IDs to risk pillars... prioritize vulnerabilities based on their detection environment, such as production versus staging."

This linkage ensures that remediation efforts are both targeted and efficient, addressing the most critical vulnerabilities first.

9. Conclusion

Kathleen wraps up the interview by acknowledging the depth and practicality of Aaron's insights into asset correlation and linking. Aaron expresses gratitude for the opportunity to discuss Nucleus Security's innovative approaches.

[12:11] A: "Aaron, thank you very much for your time today."

[12:15] B: "Of course, really appreciate it. Thank you for having me."

Key Takeaways

• Comprehensive Data Integration: Effective vulnerability management requires aggregating data from various sources beyond standard scanners, including endpoint agents, cloud environments, CMDBs, and application teams.

• Real-time Synchronization: Continuously updating asset information is crucial to avoid redundant remediation efforts and ensure data accuracy.

• Contextual Prioritization: Vulnerabilities should be prioritized not only based on their severity but also considering the context of the asset, such as its lifecycle status and the sensitivity of the data it handles.

• Asset Linking in AppSec: Tracing vulnerabilities back to their source in the development pipeline enhances the efficiency and effectiveness of remediation strategies.

• Adaptive Security Posture: As cloud infrastructures evolve, security solutions must adapt by integrating flexible and dynamic data correlation mechanisms to maintain robust security postures.

This episode underscores the necessity of advanced data correlation and asset linking techniques in modern vulnerability management, highlighting how Nucleus Security is at the forefront of these innovations.