Sunmap eBook Design

SUNMAP The cyber insight company

SUNMAP

( W O R K

I N

P R O G R E S S )

| 1

Table of Contents

■ Intro..................................................................................................................................................................... 4 ■ Continuous Discovery ............................................................................................................................ 6

Target scoping ........................................................................................................................................... 7 Smart scan scheduler ............................................................................................................................ 7 Active scanner ............................................................................................................................................ 8 Passive scanner .......................................................................................................................................... 8 ■ Map module .................................................................................................................................................. 9

Asset profiling.............................................................................................................................................. 10 Asset tagging ...............................................................................................................................................11 Search inventory ..........................................................................................................................................11 ■ Assess module ........................................................................................................................................... 12

Vulnerability manager..............................................................................................................................13 Risk Prioritisation........................................................................................................................................14 Compliance manager..............................................................................................................................15 ■ Monitor module............................................................................................................................................16

Remediate .....................................................................................................................................................16 Alert ..................................................................................................................................................................16 Report ........................................................................................................................................................... 17 ■ External scan.................................................................................................................................................18 ■ Automation................................................................................................................................18 ■ Collaboration Integration.......................................................................................................................19 ■ Subscription.............................................................................................................................20 ■ Product Road Map....................................................................................................................................20

SunMap Platform We are unique in how we empower and simplify your asset and vulnerability management. Unlike others in the cybersecurity arena, we continuously discover, map, assess and monitor all your IT, security and compliance data to provide a non-intrusive but efficient service.

SunMap provides a real-time, complete overview of your attack surface through the eyes of attackers. Most importantly, if we discover that hackers can exploit one vulnerability we go further and ask, if they can gain access to this, what can they gain access to next?

Our solution is plug and play, which is 100% agentless, effortlessly scalable and only uses data which is stored on-premises, and all at a very competitive price. Trusting a supplier is always a risk. But with SunMap, you can trust our platform by its essence.

The most impactful and easiest way to monitor your assets and security

SUNMAP

| 3

Intro Society is becoming increasingly connected via digital technologies, resulting in the exponential growth of opportunities and efficiency for companies. However, this rapid growth means cyber security practitioners need to manage a massive surge in the numbers of assets and vulnerabilities, forcing them to make security trade-offs.

The goal to be 100% secure against cybersecurity threats is an unattainable benchmark.

Instead, we believe that security should be seen as a gauge where securing the first 95% takes much less time and effort than securing the last 5%. SunMap focuses on impact first: securing the riskiest vulnerabilities and sustaining this protection level. Then companies should set strategies to counter-attack quickly once breaches happen. Our teams therefore produce agile, scalable and efficient platform that continually seek to address the core problem of every security strategy: What is my complete attack surface? What do my attackers see? What are the consequences if this asset is compromised? How can I remedy this?

SunMap has been designed to set the foundation of strong security strategies, by providing actionable cyber insights on assets and vulnerabilities, simply and efficiently. Â Discover every asset in real time to eliminate all your blind spots. Â Access an unified view of all your assets with comprehensive context in real time. Â Detect, prioritize and quickly remediate cyber exposure by utilizing the attacker’s mindset. Â Customize and share dashboards/reports across the company to ensure compliance.

SunMap’s platform is plug and play, fully agentless, doesn’t require any passwords, and stores data on-premises. Our platform provides you with an easy to use, massively scalable and secure experience.

SUNMAP

| 4

Discover

Map

Assess

Monitor

þ Continuous asset discovery

þ Complete and live asset inventory

þ Internal vulnerability management

þ Remediation project

þ CMDB/IPAM sync

þ Asset profiling

þ External vulnerability management

þ Live and customizable Dashboard

þ Intelligent scan scheduler

þ Asset tagging

þ Compliance

þ Reporting

þ Optimized scoping

þ Certificates

Scan techniques

ō Active

Environments

ō On premise

Characteristic

ō Plug and play

SUNMAP

Dot-Circle Passive

Dot-Circle Pre scan

Dot-Circle Endpoints Dot-Circle Agentless

Dot-Circle Public

Dot-Circle Container

Dot-Circle Cloud

Dot-Circle Credential less

| 5

1. Continuous Discovery Protecting unknown assets is impossible. Companies are increasingly suffering from unmanaged assets (shadow IT) and rogue devices leading to intrusion from attackers. Thus, detecting these assets and devices as soon as possible is critical.

SunMap discovers every asset in real time, eliminating all your blind spots. When unmanaged assets are detected, SunMap can automatically alert user’s XDR solutions to prompt them to install the agent.

Moreover, to avoid perturbation on the network, SunMap uses a combination of passive and active scans that communicate together to avoid scan duplications. Data collected by passive scans won’t be re-scanned by the active scanner. Conversely, when new assets or services are detected, the passive scanner alerts the active scanner to perform a new scan. Active scans are therefore only used when they are really needed, resulting in an overall less intrusive experience for the network.

SunMap implements a smart scan scheduler that helps users to organize and optimize their scans by setting key values for them.

Continuous asset visibility Collect information from new assets as soon as they connect to the network

Shadow Discovery Discover unmanaged assets and alert XDR partners if needed

Optimized scheduler Prioritize asset scanning automatically with artificial intelligence based on their profile likeliness to change

Smooth Network Reduces the numbers of scans by collecting information with passive scans and only actively scanning for uncollected information

1. Passive scan Continously find assets without disturbing the network

3. Active host scan Assess hosts vulnerabilities

SUNMAP

Attack Surface

2. Active Discover scan Find all the remaining living hosts

| 6

A. Target scoping Scoping is the process of defining the perimeter to be scanned. SunMap can detect all your assets without scoping if required. However, using our scoping feature improves the efficiency of the scanner as it does not waste time on empty scopes. This input scope takes the form of IPv4/IPv6 ranges.

Companies with IPAM

Companies without IPAM

For companies with IPAM, all the subnets are defined and tagged, and scopes are fed by the IPAM information into SunMap. Users can then activate an option to scope all the assets which are not part of the IPAM to ensure comprehensive risk management.

Companies without IPAM must rely on the RFC1819 definition. This means the scans are less optimal at the start until IPAM is selfdesigned by our tool.

B. Smart scan scheduler As companies grow, so do IT assets. Faced with exponentially increasing assets, scheduling when, how and which assets must be scanned can become a real concern.

SunMap’s optimized scan scheduler accelerates the process, keeping your time available no matter how large the company grows. Only one input is required from customers: The Minimal Time to Detect (MTD) value, which is the longest time an asset can remain without being scanned. Then, all the other inputs are automatically and smartly adapted.

MTD-dependent variables can be manually adjusted (if needed):  Timing range: Define at what time the scan runs (e.g. only night time)  Depth: Request specific level of information  Number of probes: Option to use several scanners scanning different scopes  Multiple MTD: Define different MTD depending on scope urgency (optional)  IA-based scheduler: Spot and focus on the most active target (optional) Certain asset profiles change daily while others will barely change over the course of a year.

Therefore, we provide an IA-based focus scheduler which will detect the profile volatility of your assets and automatically adapt the scheduler so it more frequently scans the most volatile.

SUNMAP

| 7

C. Passive scanner When a new device is connecting to the network, it is crucial that you immediately figure out if it represents a risk to the company. Speed is a major competitive advantage against any potential attacker.

SunMap passive scanning enables continuous discovery of assets as soon as devices connect to the network. That way, active scans only need to run when they are most needed and will have the biggest impact (new asset, new protocol used by asset, etc.).

Several discovery techniques are used including inspections of DHCP, ARP, DNS, IP and TCP packets captured from traffic sources such as the firewall log, pcap taped file, etc.

D. Active scanner Differentiating relevant and non-relevant alerts is an extremely time-consuming and challenging task for security practitioners. While one solution to this is the efficient agent-based local scanners, they detect too many vulnerabilities to be processed by humans.

SunMap’s network-based scanner provides you with the attacker’s view, showing only the weaknesses they can use to access your system. Therefore, teams can focus their time and energy on what matters the most: remediating genuine vulnerabilities with the potential to damage your business.

SUNMAP

| 8

2. Map module Every system needs a dynamic inventory technique to control the organization’s IT environment as it grows or changes.

SunMap automatically stores, classifies and structures all IT, vulnerabilities, and asset compliance as soon as they appear in the network environment. Users can easily extract actionable insights from our inventory, making it the foundation of their security strategy.

Live inventory

Asset tagging

Automatically identify and classify all your assets and vulnerabilities

Intuitively request any data on assets and export it in multiple formats

Tag your asset with default or custom fields to add business context. Tag assets to automatically categorize hosts by using network attributes, such as network address, open ports, OS, installed software, and detected vulnerabilities

Incident Response

Asset profiling

Get information about any asset present in your network when an alert is related to it

Automatically identifies and classifies the type of OS, ports, services, and certificates running on each device on the network

Complete inventory

Data exchange Cross-link data between the scan and your tools to enrich the results and leverage precision

SUNMAP

Attack follow up Leverage inventory to gain context on what went wrong and when

| 9

A. Asset profiling Securing a company network requires knowing the assets specificities. SunMap’s asset profiling collects information on assets and servers including:

Operating System

Device

þ

Device types

þ

Connection Types

þ

Location

þ

NIC Vendor

þ

MAC and IP

þ

Certificates

Application

Peripheral

Network

þ

OS Type

þ

Installed

þ Manufacturer

þ

Rogue

þ

Version Number

þ

Running

þ

Device

þ

Version Number

þ Connection type

þ

Patch level

Based on this information SunMap automatically classifies all the assets in the inventory.

Additionally, we have added AI profiling in your latest version. Humans struggle to handle too much information—AI doesn’t. SunMap provides an AI engine which is able to link all devices by their profile likeness allowing them to discover:  Similar servers  Orphan devices (often rogue devices or IT shadow devices)

SUNMAP

| 10

B. Asset tagging Managing assets efficiently requires tools that provide the flexibility to add your own business context.

The SunMap asset tagging feature allows users to add context to specific assets in order to easily track them in the future.

Automatic tagging: via integration with third-party IPAM/CMDB solutions  IPAM: If a VLAN is tagged as ADMIN in your IPAM tools, all the devices related to this VLAN can inherit this ADMIN tag  CMDB: Tag assets dynamically by owner, support teams, direction, or any relevant information that provides the most value to you Manual tagging: Users can associate a tag to one or several assets

C. Search inventory SunMap allows users to quickly access data from the profilers, scanners and tags via two powerful search options:  Filtering: Cross search, add search filters and display filters relating to any field of the devices from name to specific tag  AI search: Simplify searches with natural language powered by AI e.g.; I want to find all the devices with the tag ADMIN and a critical vulnerability associate

SUNMAP

| 11

3. Assess module Modern attack surfaces result in incredible opportunities for potential attackers. The scanners available on the market do not offer prioritization and context, meaning security teams end up wasting valuable time on vulnerabilities that won’t be exploited. In addition, scans are performed on an irregular basis, missing vulnerabilities, and are often redundant scans and lead to perturbation of the network.

SunMap quickly identifies weaknesses in your network from the attacker’s perspective, focusing on those vulnerabilities that can actually be exploited. Our module means you can tackle the most critical vulnerabilities which could lead to an intrusion and not waste time on those that won’t. We deploy internal and external scanners, with a pre-built and customizable scanning dashboard.

“ To know yo u r e n e my you s hou ld be c o m e you r e ne my” Continuous scanning

Effortless Compliance

Real-time monitoring and analysis of all attack surfaces

Execute predefined bundle of rules corresponding to public certification (PCIDSS, HIPAA, etc.)

Flexible target scanning Choose the vulnerabilities that matter for you

0-Day Vulnerabilities

Intelligent scanning

Run specific look-up scan for O-Day vulnerability and obtain visibility in seconds

Two programs run scan on the same assets, so they won’t be scanned twice

Remediation project

Security Posture Get insight and KPI for the security of your IT

Create, follow and fasten remediation project

Attack follow up

Personalized Compliance

Investigate on alert concerning a specific asset (for SOC teams)

Create and run rules that correspond to your business context

Patch management Find all your assets with deprecated version of software listening over the network

SUNMAP

Vulnerability exploitation insight Insights on the consequences if the vulnerability is exploited

| 12

A. Vulnerability manager Avoiding intrusion requires rapid and continuous assessment of IT assets weaknesses. Most vulnerability management tools are episodic and scans restart periodically, only after completion of the previous scans.

SunMap continuously and in real time detects all the vulnerabilities of the attack surface that an attacker might be able to view, providing you with your true risk exposure. It classifies vulnerabilities among several properties such as criticality, family, age, frequency, usage in real attacks, etc.

Regular vulnerability scanning will prompt you with a lot of near-useless alerts, while SunMap provides the flexibility to target the vulnerabilities that matter e.g.; if you want to scan only for critical vulnerabilities remotely exploitable, this is possible in one click.

Competitors Choose a category, a scope and a periodicity. Large companies might have over 30 scanning plans, and therefore assets might be re-scanned 30 times without adding any benefits. This results in network perturbation, assets at risk and loss of time.

SunMap Choose a category, scope and priority. For the following scan, the scheduler automatically adds the vulnerability to be scanned in the scope. We customize the scanning process to fit the needs of the clients, so for example, if two programs require a scan of the same asset at the same time, we will only scan it once.

B. Probes perspective If an asset gets compromised, companies can lack visibility on the consequences from a security standpoint. What will the attacker see? What next steps might they take? What needs to be absolutely secured?

SunMap answers this question by installing different probes in the most strategic areas of your network.

Users can select the full picture view of their environments (assets and vulnerabilities), or focus on what the attacker sees from a specific area, and therefore understand what he is able to attack.

SUNMAP

| 13

For example, understanding your attacker’s view of the office and staff is highly valuable as most attacks exploit human breaches. Therefore, we recommend installing a probe in the office environment.

C. Risk Prioritization Following up on each single vulnerability is impossible for large organizations. Efficient and accurate prioritization is therefore what makes the difference between a company that gets data stolen and another that doesn’t. The most used technique is to refer to the CVSS base score. However, this is insufficient as it lacks context. A CVSS with a score of 10% in a printer is much less critical than the same in a KPI server.

The SunMap prioritization metric is based on three layers: Carbon prioritization system

Carbon prioritization system

CVSS score

0 to 1000

Discover

Context

þ Impact

check-circle

þ Patch status

check-circle

þ Exploitability

check-circle

þ Exploitable maturity

check-circle

þ usefulness

check-circle

SUNMAP

þ Network exposure

check-circle

þ Environment

check-circle

þ Function

check-circle

þ Add own context

check-circle

| 14

The 1st layer is composed of the CVSS (Common Vulnerability Scoring System) base scores describing the vulnerability criticality. It is based on an evaluation of exploitability and the potential impact of the vulnerability on the system.

The 2nd layer contains a mitigation or aggravation factor regarding the age of the vulnerability.

It is based on several variables:  The existence of a patch and its age  The existence of a POC, exploit, tutorial to attack  The usefulness of the vulnerability in the wild and the related attacker (Script Kiddies, APT, etc.)

The 3rd layer adds context to our scoring system. It changes the score depending on several factors concerning the asset with the discovered vulnerability: Â Network exposure (Who can see the asset? The public? Your staff? Admin?) Â Asset function (Database, AD, Printer, etc.) Â Asset environment (Production, testbed, data lake, etc.)

In addition we enable users to add their own prioritization factors if needed. No one is better placed to determine what really matters than you—you know your business best. For example, while in some companies data is the most valuable asset, others may want to focus on communication systems.

D. Compliance manager Compliance requirements increase constantly and are time consuming. Outside auditing to ensure companies were keeping on top of compliance was originally intended to primarily reduce cyber exposures and thus protect customers, but companies quickly found they were using up valuable time keeping auditors satisfied.

SunMap reduces cyber exposure while maintaining auditor-approved compliance with limited effort and time. Create, check and track regulatory requirements specific to your needs in minutes with our pre-built scans, dashboards and resolution advice. Â Meet compliance standards (PCI-DSS, HIPAA, ISO 27001, SOC2 etc.)

 Create requirements specific to business context

 Streamline regulatory process

 Follow up on audits easily

SUNMAP

| 15

Monitor module A. Remediate Security is often a task best split: Security teams will take care of discovering, assessing, and prioritizing vulnerabilities while a separate team patches and updates the existing systems to address these issues. To reduce cyber security exposure, security teams need to either automate remediation or otherwise project manage update processes by following up and verifying that vulnerabilities have been remediated on time. Failure to do so can result in excessive and potentially damaging gaps in cyber security.

SunMap provides remediation advice and can help track and speed up incidence response on vulnerabilities. We not only provide action prioritization but offer guidelines to fix issues. Your existing teams can then easily and automatically integrate vulnerability remediation into your existing security workflow.

In addition, users can create a remediation project, grouping vulnerabilities and/or compliance rules that users want to resolve. Users will have full visibility over the remediation project and can track its evolution using our web user interface.

For example: 1.

Create a remediation project containing the following vulnerabilities definition: ‘All smb servers remotely exploitable’.

2. Define a remediation target, for example, 99% resolved within two months.

Alert You can set incident alerts to send when devices do not comply with your remediation rules.

Choose from a range of alerting methods to meet your needs, from a simple email to a fully enriched ServiceNow incident ticket. Then just decide who should receive the alert and our system will automatically alert the device owner if it is tagged in the device.

SUNMAP

| 16

Report Non-stop monitoring of assets, vulnerabilities and remediations projects requires a high degree of project management that provides constant and real-time data in the form of dashboards and reports. But these need to be kept up to date to prevent overlooked vulnerabilities: Static and non-customizable dashboards disadvantage you against attackers.

SunMap provides you with a cyber risk overview which leverages live dashboards and continuous scanning methods to ensure you have an accurate picture of your current risk level.  Leverage live prebuilt dashboards to provide context and analysis on vulnerability, trends and mitigations  Customize dashboards via extensive library of cards  Generate reports on-demand or automatically on scheduled time slots  Share the dashboard/report: its adaptable and can be used by top management to an IT analyst The report module shows the global progression of a remediation project or of global KPI value.

You can receive it as a PDF or dynamically visualize it in the dashboard.

SUNMAP

| 17

External scan Attacks often come from the outside. Therefore, companies should regularly conduct external scans of their networks to understand the weaknesses a potential attacker might find. You can then secure against the most essential threats.

Given how essential it is, SunMap provides an external scan solution. This scan will search for vulnerabilities among all your public scope. We will focus on non-web vulnerabilities such as weak passwords, exposed administration services, etc. This solution can be either cloud-based or connected to the on-premises solution.

Automation We help companies to automate and facilitate several processes:  Discover unknown assets and alert you to them  Search the entirety of your assets for a specific vulnerability/configuration and auto-alert  Move from the detection of the vulnerability to notifying the asset’s specific administrator in seconds  Get patching confirmation to double check the mitigation

SUNMAP

| 18

Collaboration / Integration Cybersecurity solutions must enhance each other by sharing context and data. SunMap provides extremely useful information to CMBD, IPAM, XDR tools and in turn, leverage from them to provide comprehensive cyber security protection. Here is a breakdown of how SunMap optimizes your other tools:

XDR EDR

Patch management

Alert XDR EDR provider to place an agent.

Alert your patch management tool on which vulnerabilities are unpatched

CMDB/IPAM Complete IPAM scope

HONEYPOT/ Deception solution

Vulnerability management

Locate the best place to deploy a honeypot and deception solution in your network

Input all your assets mapped from SunMap to be scanned into your vulnerability management tool

IDS Locate the best spot to implement them

Investigation Help your CIEM tools to investigate intrusions giving business context via inventory, highlighting what went wrong and when

SUNMAP

| 19