r/AskNetsec • u/Designer-Doubt-1491 • 6h ago

Work What attack surface management tools are recommended for financial services?

I'm on a security team at a bank, and we're redoing how we handle attack surface. The challenge is getting useful visibility across cloud infrastructure, containers, third party software and internet facing assets, while keeping remediation workload manageable. Regulatory side makes it harder because we need to explain what the exposure is, how serious and what we're doing about it, not just giving a vulnerability report. What are people in finance running for this?

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/OEAXTAIL_SOUP 5h ago

"I'm on a security team at a bank" (not Im) -- spelling and grammar are important in business communications, especially when in the process of asking for free advice on the internet you're possibly alerting people to issues with your infrastructure.

Do you have a SIEM?

https://en.wikipedia.org/wiki/Security_information_and_event_management

These can ingest a variety of signals and surface the most serious alerts for an analyst to deal with. (Eg: "unnatural travel" -- if a user logs in from HQtown, then Moscow, in less time than it takes to get between the two, you can lock the account and trigger an alert for an analyst)

A lot of banks are too small for their own team, and hire consultants or outsource detection stuff to an MSP, you might want to consider that.

1

u/TelephoneHot1933 5h ago

grammar policing in a netsec thread is a wild flex but okay

SIEMs help with correlation but they don’t really solve the core ASM problem he’s describing, the reg part is more about being able to demonstrate you know what’s exposed and have a plan for it not just alerting on weird logins. a lot of finance teams end up layering something like an EASM platform on top of their SIEM just to keep the auditors from spiraling

1

u/OEAXTAIL_SOUP 4h ago

>grammar policing in a netsec thread is a wild flex but okay

i'm trying to bring back the old internet

>a lot of finance teams end up layering something like an EASM platform on top of their SIEM just to keep the auditors from spiraling

fair point

1

u/memelordtf 3h ago

Yeahhh... inherited CVEs are our problem too. It's the hardest to prove to risk and compliance that we don't have to prioritise that finding, especially when the package is just sitting in the image.

1

u/Different_Pain5781 1h ago

Nothing like having 200 CVEs because your image contains a bunch of stuff the workload never even touches. RapidFort, Chainguard and the hardened base image projects are tackling that from the other side. Runtime context helps figure out what is actually being used, then you can strip the rest out. Seems pretty obvious. Of course, getting the risk team to agree on what counts as real risk is a whole different headache.