What is Attack Surface Management

 

Attack Surface Management (ASM) is the process of continuously identifying, monitoring and managing all internal and external internet-connected assets for potential attack vectors and exposures.

 

In contrast to other cybersecurity disciplines, the method of ASM is approached exclusively from the standpoint of a hacker, as opposed to that of a defense. The process involves the identification of potential targets and the evaluation of associated risks, taking into consideration the exploitable possibilities that these targets may offer to a malevolent attacker. ASM utilizes similar techniques and resources as those employed by hackers. Moreover, numerous ASM activities and technologies are developed and executed by individuals known as "ethical hackers," who possess a deep understanding of cybercriminal tendencies and are proficient in replicating their movements.

How ASM Works

ASM operates based on these five phases:

1. Discovering Assets

ASM will systematically uncover, ascertain, and delineate all cyber assets present inside the internal and external attack surfaces. Furthermore, contemporary attack surface management systems include the capability to replicate the toolset employed by malicious actors in order to identify possible vulnerabilities and weaknesses within organization's network. This significantly improves the overall visibility over the entirety of the attack surface and guarantees the comprehensive mapping of all cyber assets, which may have potentially served as attack vectors.

 

2. Classifying and Validating Asset Security

Any cyber asset can serve as a cyber attack vector, but not all assets pose the same level of risk to an organization. A modern ASM solution is able to provide a comprehensive analysis of the attack surface and provide pertinent insights about exposed assets and their context within a network. These insights include when, where, and how an exposed asset was used, as well as the asset's proprietor, its IP address, network connection points, and a few other factors that may aid in determining the severity of the organization's risk exposure. 

 

3. Continuous Monitoring

The attack surface undergoes constant changes due to the addition of new devices, assets, and people inside the network. Given these circumstances, it is crucial that Application Security Management (ASM) system have the capability to consistently monitor and test the attack surface. An optimal attack surface management solution should possess the capability to continuously evaluate and analyze all assets round the clock, with the objective of mitigating any potential security holes, vulnerabilities, and threats associated with the attack surface. Additionally, it should effectively address system misconfigurations and comparable hazards.  

 

4. Prioritizing Vulnerabilities

ASM is capable of calculating actionable risk scoring based on factors such as how visible and exploitable a vulnerability is, how difficult it is to repair, and the history of exploitation. Unlike traditional vulnerability management methods such as penetration testing or red teaming, whose security ratings can be subjective, scoring for attack surface management is based on calculated criteria. 

 

5. Remediating Threats

Based on the previous four phases of attack surface management, an organization's IT and security teams will now be equipped with the necessary data to identify the risks with the highest severity and prioritize their remediation efforts.  Since IT professionals typically lead remediation efforts, it is crucial that this information is shared with every team member and that they are all aligned on security operations. Typical remediation procedures include applying the most recent operating system upgrades, implementing a stronger encryption method, debugging application code, removing malicious assets, etc.

The Importance of Attack Surface Management

You cannot protect something you cannot see. ASM helps organizations in:

• Reducing Attack Surface - ASM helps organizations in gaining attack surface visibility and mitigating associated risks. Due to the dynamic character of organizations pursuing a cloud migration, both internal and external attack surface management are essential.
• Reducing the Risk of Intrusions and Data Breaches - ASM helps in minimizing the number of entry points and vulnerabilities in their systems and networks. Minimization ensures organization has a comprehensive and continuously updated inventory of all internet-facing assets and associated risks.
• Merger and Acquisition - A company acquires another organisation that does not have a complete IT assets list.  There are servers and other infrastructure that are not accounted for and the criticality of the systems is unknown. ASM provides visibility of the unknown systems and keeps a dynamic, running list of these assets.  The company being acquired could also use ASM during their efforts to answer due diligence questions. 
• Protect Sensitive Data - ASM is able to identify potential threats associated with its storage and transmission. For example, if a system of an organization contains confidential information about its clients but does not have appropriate authentication measures in place, hackers could easily obtain unauthorized access to this information. However, by instituting appropriate authentication measures via ASM, organizations reduce the risk of unauthorized access to sensitive consumer data and eliminate the possibility of a cyberattack.