Eclypsium®, the enterprise device security company, today announces a new technology integration with Kenna Security’s Kenna.VM, to extend risk-based vulnerability management (RBVM) to the firmware layer. The integration, developed at the request of a major financial institution and now available for other customers, provides joint customers with a consolidated and comprehensive view of vulnerability risk down to the firmware of a device.
Firmware and device-level attacks have become a staple of attackers from state-backed threat actors to financially motivated ransomware campaigns. Attackers have become increasingly sophisticated, finding new ways to introduce vulnerabilities throughout the supply chain, evade security tools, persist within compromised devices, and cause the greatest damage possible. Malware and ransomware like TrickBot have increasingly targeted vulnerabilities in firmware, giving attackers virtually complete control over a device – including the ability to subvert the operating system and other security protections. As a result, managing risks at the hardware and firmware layers is increasingly a requirement that must be integrated with an organization’s ongoing risk management efforts.
“Modern IT and security teams face a cybersecurity landscape that is both expansive and sophisticated, with the majority of organizations lacking insight into their firmware and hardware attack surface,” said Alex Bazhaniuk, Co-Founder and CTO of Eclypsium. “The integration of the Eclypsium solution and Kenna.VM changes that. For the first time, organizations can now take action with ease to reduce attack surface risks at the hardware layer.”
Eclypsium gives organizations visibility and control over their firmware and hardware risk. The solution scans devices at levels that traditional vulnerability scanners and security tools miss, to reveal device level vulnerabilities, misconfigurations, and threats. With Eclypsium, teams can easily maintain visibility into their server and endpoint hardware, and VPN and other network infrastructure to find vulnerabilities, misconfigurations, and signs that the integrity of the device has been compromised.
“Our research shows that Windows 10 hardware alone has an average of 14 high-risk vulnerabilities per device. It’s imperative that organizations have the ability to identify and remediate the riskiest vulnerabilities across their vast endpoint infrastructure at scale,” said Jason Rolleston, Chief Product Officer at Kenna Security. “Eclypsium’s integration with Kenna.VM enables our joint customers to enhance their existing risk-based vulnerability management programs with increased visibility and efficient remediation of threats that reside in their endpoint devices, down to the firmware level.”
Historically, organizations see vulnerabilities and risk at the software level. Network-based vulnerability scans often only discover vulnerabilities at the operating system or service level but lack insights into the underlying device itself. Identifying and remediating vulnerabilities at the device-level is often a manual and highly technical process that is mostly performed by exception, leading to longer dwell times when firmware attacks do occur.
The integration enables Eclypsium firmware security data to be imported into Kenna.VM, where it is combined with real-world threat and exploit intelligence and advanced data science to determine which vulnerabilities pose the highest risk and which can be deprioritized. Giving IT and security teams a complete view of their device risk and enabling them to make smarter patching and hardware configuration decisions.
