TOP 5 CISO FINDINGS OF 2022

Mark Arnold of Lares presents the top five findings his advisory team recorded across client work in 2022, drawn from virtual CISO, risk assessment, offensive testing and program management engagements. He explains that the list reflects how often each issue appeared rather than how severe it was, and that the clients ranged from mid-market firms to critical infrastructure operators. The countdown begins with weak asset management, followed by gaps in vulnerability scanning and timely patching, then blind spots caused by missing logs and monitoring.

The talk moves on to insecure default and extraneous configurations, which attackers know well and can exploit easily, and to the lack of current data flow diagrams that would make unusual traffic stand out. Arnold uses the Capital One breach, as analysed in an MIT Sloan case study, to connect these issues. A misconfigured web application firewall let the attacker reach instance metadata, retrieve credentials, and copy cloud storage buckets, with each step tied to one of the findings.

For remediation, he recommends choosing a recognised framework such as NIST CSF, mapping existing controls and gaps against it, and then designing tactical tests for each function instead of relying on a generic yearly penetration test. He points toward continuous, scripted validation, ranking and quantifying risk with a method such as FAIR, and repeating threat modelling afterward. His closing point is that buying more tools rarely fixes these gaps, and that the people operating them and the validation of existing controls matter more.