Attack Surface Management

What is Attack Surface Management?

As your organization’s number of connected devices continues to grow, so does your attack surface. Unfortunately, that expanded surface gives cybercriminals substantially more entryways into your networks and systems. As a result, attack surface management (ASM) presents a growing concern for organizations of all sizes.

Your attack surface represents the sum of all your potential doorways for hackers to enter – email servers, Internet of Things (IoT) devices, network devices, printers, cloud assets, SaaS, and more. Remote workforces compound concerns as they also contribute to your expanding digital footprint.

Equally, your attack surface extends to partner devices. Consider the number of attacks targeting supply chains, for example. Each connected device from your suppliers increases your attack surface. Moreover, your attack surface is fluid because your assets constantly change.

Attack surfaces can be physical or digital. The former encompasses endpoint devices, desktop systems, laptops, USB ports, and discarded hardware. The latter covers code, websites, weak passwords, applications, and poorly maintained software.

Ultimately, the rise in attack surfaces largely stems from three factors:

1. Enabling a workforce without boundaries: More than half of remote workers access customer data using a personal device. However, security leaders lack high or complete visibility into remote employee home networks. Hackers know this gap exists considering that 67% percent of business cyberattacks target remote employees.
2. Expanding the software supply chain: Nearly two-thirds of security and business leaders attribute recent cyberattacks to a third-party software compromise; 61% report increased risk due to their expanded software supply chain.
3. Migrating to the cloud: 80% of security and business leaders believe moving business-critical functions to the cloud elevated their risk; 62% of organizations suffered business-impacting attacks involving cloud assets.

How Attack Surface Management Helps

ASM offers a proactive approach to managing all these connected assets. It requires continuous discovery, inventory, classification, and monitoring of your organization’s IT infrastructure and assets. Unfortunately, many organizations fail to map out their attack surface continuously. And that allows vulnerabilities to go undetected.

With attack surface management, your goal is to shrink your surface area by reducing entry points, access and privilege, running code, internet-facing applications, services, and more. But the only way to accomplish that is by actively and thoroughly inventorying and classifying all your assets. Then, you can assign a risk score to those assets and remediate ones with a high score.

In addition to shrinking your attack surface, you’ll also want to streamline and optimize your IT operations. That endeavor focuses on:

• Simplifying and segmenting your network
• Gaining greater control over your endpoints
• Combining and eliminating tools
• Removing needless access
• Managing employee changes and departures to update access

ASM forces you to consider privileged access and accounts to avoid providing access to individuals unless required. And, as already stated, remember your assets are constantly in flux, making ASM an ongoing endeavor.

Deploying Attack Surface Management

When it comes down to it, ASM isn’t about technology per se. On the contrary, it’s about your mindsight and ensuring you’re deploying cybersecurity best practices. In addition, it’s about reviewing your IT environment holistically to see assets can be removed, combined, or changed to reduce your attack surface.

Security teams must beat cybercriminals to the punch and security vulnerabilities and exploits before a hacker has a chance to work their magic. When done correctly, ASM allows organizations to shut down Shadow IT assets, unknown and orphaned applications, exposed APIs and databases, and other vulnerability points.

Ultimately, ASM involves two critical elements:

1. Asset Discovery and Inventory: By inventorying known and unknown digital assets such as websites, IPs, domain names, and cloud services, you gain a clearer picture of your real-time assets.
2. Vulnerability Assessment and Prioritization: With a high volume of assets associated with your digital footprint, it’s essential to prioritize your vulnerabilities. Ranking and remediating your higher priority exposures relating to misconfigurations, open ports, and unpatched vulnerabilities becomes the goal.

Where asset discovery is concerned, you’ll want to pay particular attention to each of the following:

• Known Assets: These assets include items like your website and servers and the dependencies on running them.
• Unknown Assets: Items outside the immediate purvey of your security team like shadow IT, orphaned IT infrastructure, or forgotten sites. Gartner estimates that one-third of breaches start with unknown assets.
• Rogue Assets: This area covers malicious infrastructure spun up by threat actors and includes malware, URL hijacking, or even a mobile app impersonating your domain.
• Vendors: Third-party and fourth-party vendors introduce significant risk across your threat landscape.

During deployment, you’ll also want to establish security ratings and risk scores, continuous security monitoring, and security threat intelligence.

ASM Tools

Once you’ve fully documented your systems and assets, ASM tools enable you to uncover inroads that cybercriminals can exploit. Considering attack surface management is a reasonably new concept; however, tool availability is somewhat limited.

Essentially, vulnerability management is a subset of ASM so that you can use a vulnerability scanner or even an Intrusion Detection System (IDS). IDS looks for malicious activity, including data theft attempts. Data loss prevention tools (DLP) are also valuable for monitoring attack surfaces as their goal is to protect data from unauthorized use.

Whatever tool or tools you decide upon, they should include continuous monitoring and provide some of the following capabilities:

1. Checks for software vulnerabilities
2. Identification of outdated software versions
3. Monitoring capabilities that log data access by software
4. Distinguishing valid user activity versus suspicious user activity
5. Protecting sensitive data by identifying software security weaknesses
6. Uncovering Shadow IT
7. Discovery of external assets, including IPv4, IPv6, Cloud, and IoT assets
8. Support for threat prioritization

Another critical component is the ability to generate real-time information into your organization’s risk profile.

Security Leaders Planning to Adopt ASM

ASM solutions provide a range of security improvements to organizations that current capabilities do not. In a survey by Forrester, security leaders cited these benefits relating to ASM solutions:

1. Improving discovery and monitoring of unmanaged assets
2. Providing the ability to identify and remediate misconfigurations
3. Increasing visibility of cloud assets
4. Enhancing incident response capabilities

For these reasons, attack surface management will grow substantially. For example, Forty-four percent of surveyed decision-makers reported their organizations plan to pilot an ASM solution over the next 12 months. Another 15% noted their organizations plan to pilot this solution over the next two years.

As attack surfaces grow multi-dimensionally, adopting an ASM solution provides numerous benefits. Most decision-makers in the survey (84%) reported that a solution automating discovery and monitoring of their organizations’ external-facing assets for better risk management is vital.

ASM Benefits Organizations Large and Small

Even if you’re a small to medium-sized company, attack surface management offers a great deal of promise for keeping cybercriminals at bay.

As a managed IT services provider, we’ve helped local organizations in Harrisburg, Lancaster, York, Carlisle, Reading, and Allentown substantially improve their cybersecurity services. In fact, we’ve made their businesses virtually hack-free.

If you’re looking for added support with your cybersecurity, talk to our IT company. We’ll get the ball rolling with a penetration test that will reveal data within your network and systems open that’s open for access to cybercriminals. So call or contact us today and ask for a pen test.