Digital Risk Protection: Avoid Blind Spots with a More Complete Risk Picture

“Digital Shadows (now ReliaQuest) leads the pack for digital risk protection providers.” Digital Shadows (now ReliaQuest)’ customers have been telling us this for years, and now Forrester Research has included us among the vendors who “lead the pack” in the recently released report The Forrester New Wave™: Digital Risk Protection Q3 2018. The Forrester Research report also stated, “Customers extol Digital Shadows (now ReliaQuest) for its robust digital risk data and ability to deliver on an aggressive product road map, citing a new queryable deep and dark web search feature as evidence.”

This recognition as a “Leader” continues Digital Shadows (now ReliaQuest)’ leadership in digital risk management. We were also named a leader in The Forrester Wave™: Digital Risk Monitoring, Q3 2016.

For me, this milestone and the previous recognition as a leader have been very satisfying. When I left Forrester Research, I wanted to help security leaders and security practitioners to better understand their external risks. Digital Shadows (now ReliaQuest) is doing this, and I’m proud to make our customers’ lives easier.

What is Digital Risk Protection?

Digital risk protection consists of monitoring and remediating external risk exposure online. Forrester describes DRP solutions as those that “offer rapid event detection and remediation capabilities so companies can fix issues before bad actors exploit them…. and to limit the effects of successful attacks when they occur.” In this blog, I take a look at the current state of digital risk protection and where I see its future.

The Current State of Digital Risk Protection

One of the topics I frequently discuss with my fellow CISOs is the urgent need to have the most comprehensive view of risks possible. We have such limited resources, and if we are going to effectively leverage our people and budget, we need a more complete risk picture. If you look back over the years, we have an affinity for risk blind spots:

• Virtual servers. When VMware ESX started getting deployed, the security teams were hands-off as there weren’t any “mission critical workloads” running on them. How long did that last?
• iPhone (mobile phones). We didn’t fully appreciate the amount of sensitive data that would be on the iPhones. Containerization and Mobile Device Management solutions emerged to address these risks.
• iPad (tablets). Ever hear stories about radiologists using iPads with unencrypted personal health data on them? Yeah, me neither. #Sarcasm.
• “We aren’t using the cloud?” Ever hear this? I hear it frequently. Meanwhile: Box, Dropbox, iCloud and others are running with little understanding of the risks. Cloud Access Security Brokers emerged to address these risks.

I place external digital risks and digital risk protection in this category. If we don’t have a better understanding of our digital footprints and what is happening beyond our boundary, we are once again putting our heads in the sand.

Forrester Research discusses these challenges: “Security and risk professionals face an intimidating task: protect vital, incredibly distributed digital footprints without direct control or ownership. It’s a major challenge just to understand an organization’s far-reaching digital ecosystem, let alone protect it.” – New Tech: Digital Risk Protection, Q2 2018. In this new Digital Risk Protection Wave, Forrester adds “Security pros are turning to digital risk protection (DRP) solutions to deal with the heightened exposure their organizations’ digital infrastructure, assets, and accounts face online.”

I’m delighted with how Digital Shadows (now ReliaQuest) fared in this report, especially in terms of what we consider to be validation that our service, Search Light (now ReliaQuest GreyMatter Digital Risk Protection), received from Forrester and our clients. You can download your own copy of the Forrester New Wave here, but here are my takeaways from the report and thoughts on Digital Shadows (now ReliaQuest):

• Digital Risk Protection Breadth and Depth in One Tool. We’ve always believed that Digital Risk Management needs to encompass a wide range of sources and should not be siloed to specific areas of online activity. Our coverage of criminal forums, dark web pages, Telegram, social media, search engines, code-sharing sites, paste sites (to name a few) helps us to excel in this area.
• Strong Dark Web Visibility and Recon Capabilities. As organizations seek to better understand their exposure, we understandably get a lot of questions about the dark web. We’ve been monitoring dark web pages and criminal forums since before it was trendy. More recently, we’ve released Shadow Search (now ReliaQuest GreyMatter Digital Risk Protection); a new feature in our portal that allows our customers to query this information and set up their own alerts.
• Leading Risk Remediation. It’s great to be able to detect risks online, but if a provider can’t help to remediate this, then you haven’t solved much. In every alert, our analyst team provides context and recommended actions, including the use of our templated and managed takedowns.
• Industry-Leading Dashboard. We deliver our clients a quick and visual way of understanding their digital risks. Our main dashboard showcases the latest customer-specific alerts so that our clients can immediately identify their top priorities. Extra tabs for our intelligence database, incidents, reporting, and takedowns are also easily-navigable.
• Rich Partner Ecosystem. Organizations shouldn’t be penalized for consuming our intelligence in ways that make the most sense for them. That’s why we’ve been building our a rich partner ecosystem over the past 2 years. This provides organizations with turnkey integrations into SIEMs, Threat Intelligence Platforms, Ticketing systems and automation platforms.
• Global Reach and Analyst Expertise. Technology is important, but the true power comes when it is combined with analyst expertise. Our analysts help to remove false positives (freeing up time for you), add context, and respond to Requests for Information (RFIs).

If you want to read more on digital risk protection, check out our blog, Understanding Digital Risk Protection, or download the full Forrester New Wave Report.