Attack Surface Management

Chapter 1. Laying the Groundwork: An Overview of Attack Surface Management

A note for Early Release readers

With Early Release ebooks, you get books in their earliest form—the author’s raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 1st chapter of the final book. The GitHub repo will be made active later on.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

Attack Surface Management (ASM) is more than just a cybersecurity buzzword to help you look savvy at meetings. Respected industry analysts like Gartner have recognized ASM as a valuable framework for managing emerging threats and organizational attack surfaces since 2022. The US government, National Institute of Standards and Technology (NIST), and other regulatory bodies have increasingly emphasized the importance of reducing risk and minimizing your attack surface. ASM is designed to provide actionable insights that deepen visibility into the vulnerabilities and risks of your organization’s digital footprint. The purpose of ASM is to proactively identify threats and mitigate vulnerabilities before they become entry points for attackers.The complexity of doing this across multiple environments is both critical and challenging. For this reason, it has emerged as a strategic imperative for security teams in organizations of all sizes.

Attack Surface Management: What it is and Why it Matters?

ASM plays an essential role in efficiently managing cybersecurity programs, reducing risk, improving compliance, and proactively improving your organizational security posture to ensure business continuity and build cyber resilience. This framework encompasses several aspects designed to help determine where attacks may occur and what kind of impact they may have. It does this through a process of identifying, classifying, prioritizing, and securing all points of potential vulnerability within your organizational ecosystem — collectively known as the “organizational attack surface.”

While many organizations already have standard risk assessment methodologies, they can augment them with ASM. ASM complements and enhances standard risk assessment methodologies by providing a focused, continuous approach to identifying and mitigating potential vulnerabilities within an organization’s digital and physical realms. Unlike traditional risk assessments that occur periodically, ASM offers a dynamic, real-time evaluation of threats as they evolve, aligning closely with the NIST Risk Management Framework’s phases.

For instance, during the ‘Categorize’ phase of NIST, ASM aids in categorizing assets based on their exposure levels, feeding into more accurate risk determinations. In the ‘Implement’ and ‘Assess’ phases, ASM’s ongoing monitoring capabilities ensure that the selected security controls are implemented and effective against current threats.

By integrating ASM into a risk framework such as NIST, they break free from the more rigid assessments and more agilely adapt their security posture to proactively address known and emerging threats.

We’ll walk through each piece of the framework and use cases later, but first, let’s break down what exactly we mean when we say “attack surface”.

What Is Meant by Attack Surface?

Attack surface is a comprehensive term that describes any and every point within an organization where an unauthorized user or attacker could gain access or extract data from an environment or hijack resources for malicious purposes. We intentionally say user and attacker because there is an important distinction between the two. Attacks are often assumed to be from external third parties, generally malicious individuals or bad actors but unintentional attacks can come from users within your organization. An attack surface includes physical hardware and software-based systems, such as servers, networks, applications, and machine-automated processes. It also extends to encompass the human elements — the people who interact with these systems and the business processes through which the systems are operated as well as the environment and physical security elements. When referring to all the potential entry points to your technology within your organizational ecosystem the phase organizational attack surface is normally used.

It’s easy to focus on just the core IT components, such as servers and endpoints when discussing attack surfaces. However, it is important to understand that the overall attack surface of an IT ecosystem is far broader. Public and private network interfaces serve as gateways for data exchange and can be potential entry points for unauthorized access. Unpatched software vulnerabilities offer attackers opportunities to exploit outdated systems. Exposed databases that contain sensitive information can be targeted for data breaches. Cloud services and web applications expand the organizational attack surface further, and are all too often not properly managed and secured. The complexity of attack surface increases when you consider things like remote work, bring-your-own-device (BYOD) policies, the Internet of Things (IoT), and the supply chain. Today, our IT paradigm has shifted to ephemeral virtual infrastructure and resources where employees can access organizational resources from anywhere rather than a server room or physical computers within an office space managed directly by an IT team. This means nearly any device used by your employee, whether personal or professional, can be connected to your company’s network from any place around the world. Each of these variables increases the number of potential entry points into your organizational ecosystem (as mentioned earlier, this is holistically viewed as the organizational attack surface). The larger or more complex the total organizational attack surface, the more opportunities there are for attackers to exploit vulnerabilities and breach an organization.

Managing the intricacies of an organization’s attack surface is challenging even if an organization remains entirely static. However, the goal of most organizations, even small and medium businesses, is growth, and modern organizations are continuously changing. There are a lot of internal factors that cause changes to the organizational IT ecosystem. Factors that you might not think of as relating to the attack surface, such as adopting new software, technical debt, or onboarding a new employee, do, in fact, have an impact. Other less common internal factors might include adding new hardware, changing security policies, or adjusting employee access permissions.

External factors, such as the broader technology landscape, such as COVID accelerating cloud migration or evolving cyber threats, like the emergence of ransomware-as-a-service (RaaS), alter an organization’s attack surface. Unlike internal factors, these variables are outside of an organization’s control. The most well-known external factor is cybercriminals constantly discovering vulnerabilities in existing applications or developing new techniques and tools for bypassing security controls.

It’s important to remember that the organizational attack surface encompasses all points where unauthorized access or data extraction can occur. Because this includes IT components like servers and networks as well as human interactions and operational processes, your attack surface is dynamic; factors like cloud services, remote work, and evolving cyber threats cause it to expand. This brings us to the concept of attack vectors. Attack vectors enable hackers to exploit system vulnerabilities and much like with attack surfaces this also includes the human element.

Attack Vectors vs. Attack Surfaces

When planning and carrying out an attack on a system, the attacker needs to identify weaknesses that they can exploit and methods for exploiting these weaknesses. We refer to these weaknesses as attack surfaces and the methods as attack vectors. Attack vector refers to all the tools, tactics, and techniques used to exploit your attack surfaces. Attack surfaces are the targets or locations where attackers apply attack vectors. You might hear people use them interchangeably, but they are not synonymous. They are related but distinctly different by definition. While an attack surface is any point within an organization where an unauthorized user or attacker could enter or extract data, an attack vector is a path or a means by which a cybercriminal or malicious program can gain access to your organizational IT environment in order to deliver a payload, steal data, or perform a malicious action. Think of an attack vector as a bow and arrow while the attack surface is the bullseye. This concept is illustrated in Figure 1-1.

Figure 1-1. Here are some examples of both Attack Surfaces and Attack Vectors. These are not all-encompassing; organizations may break them down differently, such as breaking malware into smaller vectors like ransomware, spyware, etc.

Attack vectors encompass a broad spectrum of attack types, ranging from cunning social engineering attacks to sophisticated technical exploits. The popularity and usage of each vary based on the attack surface and the attacker’s preference. Attack vectors may change as new vulnerabilities are discovered, allowing cybercriminals to take advantage of security gaps and leaving security teams racing to mitigate them. As the organizational attack surface expands, potential attack vectors increase exponentially. Conversely, reducing the attack surface by minimizing vulnerable points reduces the number of potential attack vectors.

This may seem very abstract but the consequences are very real. To give you a better idea of the relationship between attack surfaces and attack vectors, we’ve listed several examples of attack vectors below. In each example, we noted the real-world breaches that resulted from the successful use of each type of attack vector as well as the attack surface.

• Social Engineering Attack: These attacks manipulate individuals into revealing confidential information or gaining unauthorized access to systems. These often involve deceptive communication methods like phishing or impersonation.

  • Example: In Q3 2023, a surge in social engineering attacks was noted, with the K2A243 (SCATTERED SPIDER) group using sophisticated email phishing scams, including attacks via Microsoft Teams using DARKGATE malware.

    Employees with access to the systems and the secondary attack surface was email were the primary exploited attack surface. The employees were tricked through social engineering into exposing their credentials via SMS. The email component was used to help deliver messages convincing them to install the tools and malware. Without an effective defense, nothing prevented them from getting through. Each of these elements was necessary to the success of this complex attack.

    Attacks like this contributed to a rise in social engineering and an increase in Business Email Compromise (BEC), where attackers deceive employees into transferring money or providing sensitive information​​​​.

  • Attack Vector: emails and text messages

  • Primary Attack Surface: Employees

  • Secondary Attack Surface: Email Systems

• Software Exploit: These are attacks that exploit weaknesses or vulnerabilities in software or hardware to gain unauthorized access or cause disruptions. These often involve sophisticated hacking techniques.

  • Example: In December 2021, the Kaseya ransomware attack exploited a vulnerability in the company’s software, impacting over 1,000 companies globally. Orchestrated by the REvil group, the attackers demanded $70 million to decrypt the data​​.

    In this case, the primary attack surface are the vulnerabilities in the Kaseya software that was exploited by REvil. This provided the entry point for the attackers to inject ransomware into the system. Without this opening, many of the systems that fell victim would have been otherwise untouchable.

    The servers that automatically ran software updates from Kaseya, configured to automatically trust the provider were an additional component of the attack surface. They could not have installed the tainted software without this inherent trust, which allowed the attack to take place.

  • Attack Vector: modified software

  • Primary Attack Surface: Kaseya Software

  • Secondary Attack Surface: Servers running Kaseya

• Malware Attacks: Malware attacks involve malicious software such as viruses, worms, trojans, and ransomware being installed on a victim’s system without their knowledge. These can lead to data theft, system damage, or unauthorized network access.

  • Example: The University of California, San Francisco, faced a malware attack in November 2021. The Conti ransomware group used a phishing email to install malware, resulting in data theft and file encryption, with a ransom demand of $1.14 million​​.

    The Conti group used the email system as their primary attack surface, sending infected emails to it. They were allowed to spread to employees who opened the emails because no filtering software was implemented that could detect the malicious emails. This meant the Conti group was able to launch the payload and infect their devices. As these organizational devices had no sufficient means to stop the malware, their vulnerability was exploited, making them an additional part of the attack surface.

  • Attack Vector: emails

  • Primary Attack Surface: Email Systems

  • Secondary Attack Surface: End User Devices

• Man-in-the-Middle (MitM) Attacks: In these attacks, the threat actor secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other. This can lead to data theft or manipulation.

  • Example: In April 2018, Dutch authorities caught four Russian intelligence officers from the GRU cyberhacking team attempting to conduct a MitM hacking operation targeting the OPCW’s wifi network.

    The attack surface was the OPCW network infrastructure that allowed individuals to hijack the network and intercept traffic. The infrastructure lacked appropriate controls to detect a rogue access point that could intercept user traffic.

  • Attack Vector: WiFi

  • Primary Attack Surface: Network infrastructure

• Insider Threats: These occur when someone within the organization, such as an employee or contractor, abuses their access to compromise the organization’s security, intentionally or unintentionally.

  • Example: In April 2023, the FBI arrested a member of the Massachusetts Air National Guard for leaking top secret and classified documents to post online.

    This individual used overly permissive access rights to steal data that they were able to access. Failure to adhere to the principle of least privilege coupled with the inability to adequately detect suspicious usage patterns, allowed this misuse of access in the data storage and exposure of sensitive data to take place rather than being stopped before data was leaked.

  • Attack Vector: Misuse of Access Rights

  • Primary Attack Surface: Access Privileges

  • Secondary Attack Surface: Data Storage Systems

While this is not a complete list of attack vectors, these high profile breach examples highlight the wide range of unique threats to organizational security and demonstrate the need for distinct prevention and mitigation strategies. One key aspect to note here is that a single attack vector can target multiple attack surfaces. Attack surfaces and attack vectors rarely have a one-to-one relationship.

The fluid nature of attack vectors is notable. These are in a constant state of evolution as attackers find new paths around organizational defenses. This reality underscores the need for continuous vigilance; there is no silver bullet, no defense that is one hundred percent foolproof. No matter how innovative our security measures become, cybercriminals will find ways to circumvent them. This is why we must be prepared for emerging threats and zero-day attacks.

That’s not to say threat actors won’t use tried and true exploits of long-existing vulnerabilities. In fact, that is usually where they start. However, they don’t stop there. Once well-known exploits and low-effort attacks fail, cybercriminals double down on their efforts, seeking out novel and inventive methods to breach defenses. This is part of what makes attack surface management challenging and crucial for any growing organization.

What is Attack Surface Management?

Now that we better understand attack surfaces and attack vectors, let’s take a look at exactly what attack surface management is and why it matters. ASM is the fundamental understanding, analysis, and management of attack surfaces. It covers identifying, assessing, and mitigating vulnerabilities across an organization’s digital footprint.

So why does this matter to your organization? ASM helps you understand your entire organizational attack surface and correctly prioritize what protections you implement allowing you to get the best possible results from your cybersecurity investment. It’s a well known fact that we can’t stop every attack. Additionally, cybersecurity teams operate with finite resources, which that means we can either play whack a mole with cyberattacks or we need to adopt a strategic, organized approach to handling threats and vulnerabilities and reducing risk. This is where ASM comes in. ASM helps security teams identify and focus on the assets that have the greatest impact on your cybersecurity posture.

The strategic nature of ASM accommodates the constantly evolving threat landscape and the less dynamic organizational attack surface that, while generally static for periods, does shift to keep pace with new technologies and changing business processes. By encompassing these aspects of an organization’s digital presence, ASM provides a holistic approach to defending organizations against a wide array of cyber threats. The ongoing nature of ASM, through monitoring and adapting, ensures that as vulnerabilities are identified, they are assessed in terms of their potential impact. Once assessed, the vulnerabilities can either be eliminated or their impact effectively mitigated to holistically improve the quality of cybersecurity defenses.

The attack surface of modern organizations has undergone significant change in recent years. A multitude of global factors initiated a shift from strictly traditional office roles to a mix of traditional, remote, and hybrid workforce models as well as driving the acceleration of cloud adoption. These, in turn, eliminated the reliance on the once-trusted internal network perimeter where much of the security was provided by internal networks. Employees now access corporate resources both on premises and in the cloud, from a range of geographical locations and leveraging public and personal networks, sometimes even using personal devices. All of which renders traditional defenses like firewalls and ACLs less effective.

With remote operations, organizations can maintain some devices’ security by enforcing patching and security policies. Still, they cannot extend that level of control to the vast array of the networks employees now use, such as at home, in coffee shops and libraries, or even in hotels. This expansion of the possible attack surface has necessitated a combination of old and new security strategies focusing on reducing external connection risk. Virtual Private Networks (VPNs) have long been a standard for ensuring safe connections between the client and the office. Companies had to expand on this to incorporate access monitoring, threat detection, and more robust access controls to account for threats where the device or user’s credentials were compromised.

There has also been a significant increase in collaboration and communication platforms like Slack, Microsoft Teams, and Zoom to facilitate the global workforce. These platforms have become indispensable tools for facilitating effective communication and collaboration across geographies and time zones.

However, with this reliance comes inherent risks and an expanded attack surface, particularly concerning the sharing and storage of information. While enhancing productivity and connectivity, these platforms can also be potential targets for data breaches, unauthorized access, and information leaks, especially if sensitive or proprietary information is shared. The ability to rapidly collaborate and share data also allows for the rapid sharing of dangerous content, including files infected with hidden threats such as ransomware, rootkits, or malware.

Along with challenges in remote access and collaboration, organizations have transitioned from traditional on-premises IT environments to cloud-based services and tools, which is a significant shift in how organizations manage their data and operations. This shift has been driven by the need for better access to a global workforce, the desire for faster development cycles, and the advantages of scalable, cost-effective operations.

Cloud-based services offer unparalleled flexibility and efficiency, allowing organizations to rapidly scale up or down based on their needs. However, adopting cloud technologies brings unique challenges, particularly in terms of security.

One of the primary security implications of widespread cloud adoption is the shift to shared responsibility models for security. In these models, the cloud service provider and the client organization are responsible for different security aspects. Many organizations, however, were not fully prepared for this shift and found that their existing tools and technologies were not always compatible with cloud environments or as effective in securing them. Compounding this was a move toward newer technologies such as containerization where traditional IT security teams struggle due to lack of training or preparation, causing the attack surface to grow and creating massive exposures. This lack of preparedness can lead to vulnerabilities in safeguarding sensitive data.

Compounding this is multi-tenant cloud environments, where resources are shared among multiple users, such as in many SaaS environments. The risk here is twofold: firstly, sensitive data could potentially be exposed to other tenants or the cloud provider itself, and secondly, if the cloud provider suffers a breach, it could lead to the exposure of an organization’s data. Understanding what data is stored in these places is a core part of managing the cloud attack surface.

Special attention must be given to the array of heterogeneous devices populating the modern network environment. IoT sensors, operational technology (OT) systems, and smartphones represent diverse, often less-secured nodes that significantly expand an organization’s attack surface. These devices vary widely in their operating systems, security protocols, and susceptibility to threats, making securing them uniquely challenging.

It is important to remember that even though most of the technology discussed so far pertains to internal operations, the attack surface extends well into customer-facing infrastructure. This shift is particularly pronounced with adopting APIs and online services that interact directly with customers. These interfaces often serve as critical gateways to organizational data and services, making them attractive targets for cyberattacks.

Part of the drive for ASM is the evolution of cyber threats over time. These threats have increased in sophistication and diversity, fundamentally altering the cybersecurity landscape. Initially, cyber threats were relatively straightforward and limited in scope, often targeting specific, well-defined system vulnerabilities. However, with technological advancements and the increasing complexity of IT environments, these threats have become more intricate and varied, encompassing everything from advanced malware and ransomware to complex social engineering and state-sponsored cyber-attacks. Observing these developments, you may recognize a similar evolution in your own organization’s challenges. This shifting paradigm underscores the importance of rethinking our cybersecurity strategies. Traditional security approaches are often inadequate against these sophisticated threats. For this reason, many organizations adopt strategic and dynamic methodology, like ASM, which offers a proactive framework to identify, classify, and address vulnerabilities before they can be exploited.

One change that has driven this need for proactive defense is the significant evolution of cybercrime through the emergence of Advanced Persistent Threats (APTs) and targeted attacks. APTs represent a new level of threat, typically but not exclusively state-sponsored or originating from highly organized criminal entities, focusing on prolonged and stealthy operations against specific targets. These attacks often aim at espionage, data theft, or causing long-term damage to critical infrastructure, distinguishing themselves from more opportunistic cybercrime through their persistence, level of sophistication, and the significant resources behind them. APTs often leverage a combination of tactics simultaneously to create numerous points of ingress, allowing them recurring access to targets, even if a few ways get shut down.

While APTs demonstrate the high level of sophistication and resources behind state-sponsored and organized cybercrime, a similar advancement trend is evident in the realm of malware. In ransomware as-a-service (RaaS) attacks, the RaaS groups are not focused purely on malware delivery but often thoroughly breach an environment before they ever start deploying ransomware payloads. They establish future points of entrance, and plant hidden inactive malware allowing them to restart future attacks with ease, even after defenders believe their organization has survived an attack.

This evolution of malware reflects a parallel escalation in the methods used by cybercriminals, moving beyond traditional attack vectors to more insidious and hard-to-detect techniques. These attacks are no longer just simple email attachments. They now frequently leverage complex phishing schemes, exploiting human vulnerabilities to gain access to networks or uploading infected files via trusted pathways, such as web portals used by contractors or third parties, making detecting and preventing these attacks more challenging.

Attacks such as XZ do just this, compromising open source software libraries that were assumed to be trustworthy surface, subverting it to embed a malicious payload into software using this compression library. The library’s repository was assumed safe and managed through the crowd-sourced process that open-source code relies upon, but malicious actors manipulated the process by being “helpful” allowing the toxic code payload to be inserted and approved inot the codebase.

To complicate this further, they have developed new malware strains and attack vectors, including advanced ransomware and rootkits, as well as hidden threats embedded in seemingly “safe” file types like documents. This evolution has rendered traditional solutions less effective, as the rapid change in attack methods means that signature-based detection often can’t keep up. Even behavioral identification techniques, which look for patterns of malicious activity, are being circumvented by newer, more sophisticated attacks.

Phishing attacks, mirroring the evolution of malware, have undergone a significant transformation to become highly sophisticated and targeted threats. Gone are the days of generic, easily spotted phishing emails; today, attackers craft deceptive messages meticulously tailored to individual recipients or specific organizations. This customization increases the difficulty of distinguishing between legitimate communications and malicious ones.

Attackers often conduct thorough research to personalize their approach, leveraging social media and publicly available information to create convincing scenarios. They expertly mimic communications’ tone, language, and visual design from trusted entities, such as financial institutions, government agencies, or familiar corporate entities. By exploiting social engineering tactics, these advanced phishing attacks effectively manipulate recipients into revealing confidential information, such as login credentials or financial details, or unwittingly execute actions that compromise their organization’s security, like transferring funds or granting access to restricted systems.

As we see with the advanced techniques used in APTs, malware, and phishing, the cyber threat landscape continually evolves, becoming more complex and challenging to navigate. This trend paves the way for emerging threats, which harness the latest technological advancements such as Artificial Intelligence (AI) and Machine Learning (ML). These emerging threats represent the next frontier in cybercrime, further complicating the intricate cybersecurity landscape.

While AI and ML technologies have significantly advanced threat detection and response, they have also simultaneously opened doors to new vulnerabilities. For instance, cybercriminals can harness these technologies to develop adaptive malware. Such malware could use machine learning algorithms to analyze and understand the defense mechanisms it encounters, allowing it to modify its code on the fly to evade detection by antivirus software. An example of this is polymorphic malware, which can constantly change its underlying code and signature, making it incredibly challenging for traditional, signature-based antivirus solutions to identify and neutralize it.

Furthermore, AI and ML can be exploited for large-scale, automated cyber-attacks. Attackers could deploy AI-driven bots to conduct widespread phishing campaigns, where each message is uniquely crafted to target specific individuals, increasing the likelihood of success. These bots can learn and improve, adapting their messages based on user interactions to become more convincing. AI can also be used in more complex cyber-attacks like Distributed Denial of Service (DDoS) attacks, where it optimizes attack strategies in real-time, making them more disruptive and harder to counter. The use of AI in such scenarios represents a significant escalation in the cyber arms race, as it equips cybercriminals with tools that can analyze vast amounts of data, identify vulnerabilities faster, and execute attacks with unprecedented efficiency and scale.

This evolution across multiple vectors has dramatically expanded the potential attack surfaces for organizations. As these modern threats no longer just target traditional internal IT infrastructure, organizations must account for vulnerabilities in cloud services, mobile devices, IoT devices, and human elements, making attack surface management necessary. This might lead you to think that ASM is just another form of Vulnerability Management but it would be more correct to say that Vulnerability Management is actually a small part of the ASM framework.

Vulnerability Management, while essential, operates with a limited scope focused primarily on identifying and mitigating specific system vulnerabilities. When utilized independently, this approach can overwhelm organizations with extensive lists of vulnerabilities, making it difficult to prioritize effectively without a broader strategic context. In contrast, ASM enriches information from vulnerability management solutions by integrating it within a wider organizational framework, enabling security teams to focus efforts where they can most significantly improve security posture without negatively impacting business objectives. For more detail, see “ASM vs. Vulnerability Management”.

ASM vs. Vulnerability Management

Vulnerability Management is a fundamental component of ASM but it has a narrow focus on discovering and mitigating vulnerabilities within a specific system, application, or a network. This process involves scanning for weaknesses, identifying them, and then taking steps to address these issues. However, when Vulnerability Management is used by itself, organizations are often overwhelmed by an extensive list of findings. Without a broader context, this can result in a challenging situation where prioritizing which vulnerabilities to address first becomes a daunting task.

Without integrating additional layers of analysis and insight, Vulnerability Management alone may lead to a reactive approach, where organizations constantly try to patch vulnerabilities without a strategic plan or understanding of their broader impact. This neverending hamster wheel causes organizations to spend most of their time addressing urgent and important vulnerabilities without having time to address the important ones proactively before these become critical. Vulnerability Management zooms in on specific vulnerabilities leading to awareness and possibly actionable advice on mitigation, but attack surface management assesses the overall risk landscape and all potential weak points.

ASM leverages the findings from vulnerability management solutions and contextualizes them within the broader framework of the organization’s operations and business objectives. This means identifying vulnerabilities, understanding how they fit into the attack surface, and assessing their potential impact on the business. By doing so, ASM enables organizations to prioritize vulnerabilities based on their relevance and potential damage, ensuring that resources and efforts are focused on areas that yield the most significant impact on the investment. This approach transforms Vulnerability Management from a simple checklist of security gaps into a strategic tool, aligning cybersecurity efforts with business goals and facilitating a more proactive and effective defense against cyber threats.

The Components of ASM

ASM comprises six core steps that help establish a baseline of what assets exist and their overall value to the organization. These steps build on each other, creating a foundation of data that feeds into subsequent steps, as shown in Figure 1-2. These steps are components of ASM that cover everything from the initial discovery of the attack surface through monitoring and management. Using ongoing monitoring, we can identify and adapt security controls, policies, or procedures as needed to continuously improve our risk posture. Like many processes in cybersecurity, ASM is not a one-time project but a cyclical one, requiring repetition, particularly when the IT ecosystem changes or the threat landscape evolves. We’ll break down ASM into these components and discuss each in more detail.

Figure 1-2. Figure 1-2. As with many security processes, ASM contains multiple components. Effectively managing your attack surface is a continuous process of identifying, classifying, prioritizing, and remediating all of the various points where an attacker can try to enter or extract data from an organizational environment.

Identification

The first step in ASM primarily focuses on understanding what exists within the organizational ecosystem. This process entails a thorough exploration in which each technology within the organization’s IT ecosystem is systematically identified and cataloged. This includes recognized systems as well as those that are unknown or possibly overlooked, often termed ‘Shadow IT.’ Identifying these assets forms a solid foundation for developing a baseline security strategy.

While similar to traditional asset management in IT, there are core differences in how ASM handles this process of inventory assessment. Let’s break this step down further.

The scope and nature of assets

Traditional asset management focuses primarily on tangible IT assets within the organization, such as hardware, software applications, and network devices. This approach involves maintaining a detailed inventory of these assets, tracking their usage, and managing their lifecycle. Conversely, ASM expands the scope to include intangible assets like data, user accounts, and cloud services, as well as external elements like third-party services and supply chain components. ASM aims to identify all potential attack points, including assets often overlooked in traditional asset management, thereby providing a more comprehensive view of the organization’s attack surface.

Identifying unknown and dynamic assets

A traditional asset management inventory is simple and relies on a static mapping of known and regularly tracked assets. However, ASM goes beyond the standard IT stack, looking for known and unknown assets, including brief and dynamic ones, such as temporary cloud instances or containers. ASM leverages dynamic discovery and constant monitoring to keep pace with the rapidly changing nature of modern IT environments, especially the cloud, ensuring that no potential vulnerabilities are overlooked.

Achieving visibility and coverage

The visibility in standard asset management is often limited to assets within the controlled IT environment. ASM, however, seeks broader visibility, extending its reach to include BYOD or shadow IT and emphasizing the understanding of an asset’s external exposure. ASM tools employ advanced techniques like external scanning and threat intelligence to identify assets exposed to potential attackers, thus providing a more holistic view of an organization’s vulnerabilities.

Understanding asset context

Context for traditional asset management is concerned with focusing on operational aspects of assets, such as performance, maintenance, and compliance. ASM takes a deeper dive into the security context of assets, focusing on how assets could be exploited, assessing their security posture and significance in the organization’s overall attack surface. The information gathered by this approach is vital for understanding the security implications of each asset and how it contributes to the organization’s susceptibility to cyber threats.

Taking a proactive security-centric approach

Goals of standard asset management processes highlight information about asset utilization, cost, and lifecycle management. With ASM’s security-centric approach, prioritization is placed on identifying vulnerabilities, misconfigurations, and potential attack paths so remediation can be prioritized and managed proactively.

Classification

While asset identification establishes what exists in the environment, it does not provide context on the importance of each asset. This step addresses this by categorizing these. This involves classifying assets based on various criteria, such as data type, compliance requirements, functions, and relevance to security.

To effectively manage an organization’s attack surface, we need to differentiate between asset classification and data classification. While both processes involve categorizing elements based on sensitivity and risk, asset classification focuses on the devices, software, and systems as a whole, considering factors such as their role in business operations, vulnerability to threats, and potential impact of compromise. In contrast, data classification addresses explicitly the type of data an asset handles—such as confidential, private, or public information—and the security measures necessary to protect it.

The classification of an asset can indeed be influenced by the type of data it processes or stores; however, the criteria and implications of classifying assets versus data are distinct. Understanding this distinction is vital for teams to implement appropriate security controls and compliance measures, ensuring that their assets and data are adequately protected according to their respective classifications.

Let’s consider what this means.

Tailoring security controls

Different assets have different security needs, and asset classification allows organizations to tailor security controls appropriately. For example, consider two organizational databases, one containing sensitive data and the other managing publicly accessible data. While both may require strict access controls and regular backups, the one with sensitive data requires encryption of sensitive fields. The asset classification highlights the different needs, allowing organizations to implement adequate security controls where these matter most. This helps organizations avoid broadly scoped security rules that over-protect assets that don’t need it or under-protect those that do.

Determining compliance needs

Security needs don’t just focus on the challenges from outside attackers; these often have to include compliance with governance, legal, and regulatory requirements. Asset classification plays a pivotal role in ensuring these meet current needs. Categorizing assets must have a data focus highlighting when a given data type falls into a regulated category. For instance, an asset containing personal health information would be classified for HIPAA compliance and require specific security and privacy controls. Without factoring in these needs, it would be easy to overlook required controls, leading to penalties, fines, and damage to the organization’s reputation.

Planning for incident response and recovery

Asset classification also highlights what is most important to business operations, helping improve business continuity by developing incident response plans that prioritize these assets to ensure faster recoveries with less downtime. An example of this would be restoring web services and their supporting infrastructure indispensable to customer operations. This prioritization in planning helps organizations maintain operational continuity even in the face of security incidents, minimizing the impact on business functions and reputation.

Prioritization

ASM recognizes that not all vulnerabilities or exposures carry the same level of risk, especially when considering the associated assets. It is necessary to prioritize vulnerabilities based on their potential impact versus the asset’s value to the organization. This approach ensures the effective allocation of an organization’s limited resources to manage the attack surface. There are many ways to establish this prioritization, and we will explore these more thoroughly in chapter five, including discussing quantitative and qualitative risk assessment methods and their role in the prioritization process.

Asset classification drives the prioritization process in ASM, allowing organizations to manage security resources effectively by identifying and categorizing assets based on their criticality and vulnerability. Servers containing sensitive data or systems that are externally accessible and other high-risk systems are given priority in applying security controls. These systems are prioritized using security measures such as frequent patching, robust monitoring, and stringent access controls. This does not mean that other systems are ignored; it just shifts the focus to those that need it most. By ensuring the most vitally important assets are prioritized for protection, organizations gain the most significant reduction in risk for their resource investment.

Securing

Once priorities are established, the next step is securing high-priority attack surfaces. This involves remedying vulnerabilities and misconfigurations that expose the asset, which includes implementing targeted controls to address exposures within the attack surface. Given the resource constraints most organizations face, ASM underscores the importance of strategic security measures — securing everything perfectly is not feasible, hence the need for a focused approach.

One of the core drivers of ASM is the need for organizations to balance the limited resources with the need to secure their attack surface. The information from the identification and classification phases helps to drive the prioritization by determining vulnerabilities and misconfigurations that pose the greatest threat. The difference between this and standard Vulnerability Management is that ASM leverages a deep understanding of the organization’s security posture and the potential impact of different threats. In contrast, traditional Vulnerability Management simply focuses on prescribed scores.

Organizations face a flood of data from vulnerability management tools, leading to more vulnerabilities that can be efficiently tackled. Even if an organization focuses purely on high-priority vulnerabilities, eliminating them may not effectively reduce risk. For example, eliminating 20 critical vulnerabilities on a legacy server that is about to be retired and only resides on the internal network is likely less effective than removing one on the publicly exposed API for the organization’s e-commerce site. ASM uses business context information so organizations can target security controls in areas where they will yield the highest reduction in actual risk rather than just checking off boxes for security.

Adapting

In tandem with monitoring, ASM involves regular adaptation to the changing landscape. As organizations grow and their digital footprints evolve, so does their attack surface. Periodic reassessment and adjustment of security strategies are necessary to keep pace with these changes, ensuring the organization’s security posture remains robust and responsive.

As we’ve mentioned previously, traditionally organizations often have a fairly static attack surface for extended periods of time, but over time, especially in a growing organization, events or situations occur that necessitate changes to the IT ecosystem. However modern organizations are built on fast growing and evolving IT infrastructure with CI/CD pipelines pushing constantly changing code, teams adding new supply chain vendors, and even marketing people pushing random scripts onto the main site without security review causes the attack surface to be constantly in flux.

Even for more static organizations, standing up new physical or virtual systems, adding new software, adopting a new service provider, even building out a new satellite office are all examples of common changes organizations face that might expand the attack surface. It’s important to note that change does not always grow the attack surface and sometimes it shrinks it. Deprecating old systems, removing unused software, and eliminating unused ports shrinks attack surfaces.

When there is advanced knowledge of these impending changes, they can be planned. Planning makes it easier to work through the ASM framework and adapt current security controls, policies, or procedures to meet the needs of the modified attack surface to maintain a robust security posture.

Monitoring

The attack surface is dynamic, evolving constantly with changes in the IT environment and emerging threats. Continuous monitoring is thus integral to ASM, enabling the timely detection of new risks and vulnerabilities. This ongoing vigilance is vital to maintaining an effective security posture.

The use of continuous monitoring is crucial to an ASM practice. It leverages ongoing surveillance of all network assets, detecting changes in the attack surface, and identifying new vulnerabilities as they emerge. Organizations can promptly respond to new threats, patch vulnerabilities, and adjust their security strategies by implementing tools and protocols that provide real-time or near-real-time monitoring. This proactive approach not only helps in immediate threat detection but also contributes significantly to the adaptability of ASM.

The need for continuous monitoring is also driven by the perpetual evolution of cybercriminals. An organization never has a permanently “secure” state as the threat landscape is ever-changing. Continuous monitoring feeds into this adaptability, offering insights into emerging trends and potential future threats, enabling organizations to stay ahead of attackers and continuously refining and updating their defense mechanisms to remain in line with the latest security developments.

The Strategic Role of ASM in Cybersecurity

It’s important to consider the role of an attack surface as a strategic roadmap for cybersecurity teams. This becomes increasingly valuable in the context of limited resources and the overwhelming volume of data generated by existing security tools because it allows teams to focus their security efforts. ASM acts as a roadmap, showing the vulnerable spots that need protection. In today’s cybersecurity landscape, organizations face a deluge of vulnerabilities and potential issues, far exceeding the capacity to mitigate them all.

This reality is further compounded by the prevalent shortage of skilled cybersecurity professionals, leading to teams that are often understaffed and overburdened. In such an environment, understanding and mapping the attack surface is not just beneficial; it’s imperative because it enables organizations to effectively sift through the vast array of data and vulnerabilities, identifying and focusing on the high-priority areas that pose the most significant risk to their operations. By prioritizing these key vulnerabilities, cybersecurity teams can strategically allocate their limited resources, directing their efforts toward implementing targeted security measures where they are most needed.

The dynamic nature of the attack surface makes ASM a journey and not a project that can be completed. No organization remains static; its attack surface inevitably changes as it grows and evolves, adopting new technologies and modifying existing systems. This continuous evolution is not just about introducing new technologies but also encompasses changes in operational processes and the emergence of new threats. Maintaining an up-to-date understanding of the attack surface is imperative in such a fluid environment. Organizations must constantly monitor these changes and adjust their security strategies to address new vulnerabilities. Failing to do so can expose an organization to potential security gaps, and this lack of awareness leads to security breaches.

Lastly, managing the attack surface is essential for compliance with regulations and standards such as PCI-DSS, HIPAA, GDPR, and SOX. These standards require strict adherence to security procedures that prevent the dissemination of customer data. Data breaches or other security incidents caused by inadequate controls will have significant legal consequences that can directly affect an organization’s bottom line through direct fines, lawsuits, or costly mandatory remediation plans.

Regulatory failures also come with less direct costs such as SEC Materiality guidance, cost of class action law suits, impact to stock priese and loss of customer trust. Customers are more savvy and factor how well their data is protected into whether they wish to do business with a company. Organizations who are victims of a data breach, especially if due to their own mismanagement, suffer a loss of customers, and regaining those that left takes more than waiting it out. It requires showing a fundamental change in how the organization prioritizes security, such as is provided by ASM.

Adopting the Attacker’s Perspective

Attack Surface Management represents a significant shift in cybersecurity, moving from a purely defensive posture to one that incorporates elements of offensive strategy. By adopting an attacker’s perspective, ASM offers a more comprehensive and proactive approach to securing IT environments by incorporating offensive strategy elements into traditional defense postures. Beyond this, it also helps validate that ASM is working and delivering the necessary protection.

Changing Your Point of View

ASM represents a transformative concept. Most organizations focus their security with a defense-centric mindset, sometimes called ‘blue team’. The blue team is a very defense-centric mindset aimed at protecting information systems against cyber attacks by identifying vulnerabilities, implementing security measures, and continuous monitoring. Some organizations also leverage a offense-centric approach, or ‘red-team', in which security team members aim to circumvent and penetrate defenses, highlighting where controls are insufficient or altogether lacking.

ASM requires a significant shift to include thinking like an attacker. However, making this transition can be challenging. As security professionals, we are traditionally conditioned to focus on defense. We’re taught to prioritize safeguarding assets, monitoring activities, and responding to threats.

Attackers, typically driven by goals like financial gain, hacktivist mentalities, or political motivations, often aim for minimal effort and maximum anonymity. This spurs creativity and strategic thinking. They search for that pivotal weak point that offers the most leverage in an attack. Embracing the attacker’s point of view requires a fundamental change in approach, and innovative thinking. Moving to this more offensive perspective involves several key steps: First is the identification of vulnerabilities within the system. Then, it requires a thorough analysis of why these vulnerabilities might be attractive to an attacker.

Next is the pivotal step of adopting the adversaries’ mindset and considering questions such as, “If I were the attacker, which targets would appear most attractive? What tactics would I employ to exploit these vulnerabilities?” Engaging in this kind of strategic thinking is mandatory for shifting from a reactive to a proactive stance in cybersecurity, allowing for the anticipation of potential attacks rather than merely responding to them after they occur.

Seeing the whole picture

Adopting the attackers mindset necessitates we ‘see the whole picture’ and understand the context of an organization’s vulnerabilities. Security professionals often grapple with a fragmented view of their organization’s security landscape. This fragmented perspective can be attributed to time constraints and the complexity of large-scale IT infrastructures. Existing tools often only give visibility into specific areas, such as the cloud. While the findings in that area may be in-depth, they often lack the context of the business flow or the integration or interaction of other IT assets, which limits the actual value.

On the other hand, attackers meticulously analyze the business context and operational flow to pinpoint areas most susceptible to impactful attacks or deeper system penetration. This approach goes beyond mere technological vulnerabilities; it encompasses a comprehensive evaluation of business processes, data flow, and human elements that could be potential targets.

ASM challenges the narrow focus we previously used by advocating for a holistic view of an organization. By mirroring an attacker’s broad perspective, security teams can more effectively identify and strengthen vulnerable areas, ensuring that no sensitive aspect of the organization’s operation is left unguarded against potential threats.

Getting a holistic view leverages the information gained through a risk assessment extending beyond the conventional technology stack. This may seem overwhelming initially, but it does not have to be done all at once. By prioritizing and phasing the assessment process, the task can be broken up into digestible pieces that eventually account for all organizational assets.

The asset inventory is our foothold in this phased process. Knowing what we have, we can make a game plan for implementing the risk assessments. The inventory ensures that when we scope the risk assessment, we include all the assets of our most critical or vulnerable areas, such as key data assets and essential workflows.

We might start with our cloud infrastructure, or if that is too broad, we can narrow it down to just a specific set of our e-commerce systems. By breaking it down this way, resources can be better planned and allocated. Hence, the ASM process is systematic rather than a sprint toward a monolithic goal, which will almost certainly end in failure if approached in this manner.

The risk assessment will eventually encompass all facets of the business, including operational workflows, data management practices, and the roles of human actors within the system. Of course, this is part of the end game because such an all-encompassing approach gives us the full visibility to understand how different components interact and potentially create risk.

This interaction is seen when mapping out potential attack pathways. Viewing how disparate IT systems interface, less obvious vulnerabilities emerge where sensitive information might be exposed, or exploitable entry points may exist. By thoroughly mapping these pathways, organizations can gain valuable insights into their security posture, allowing them to preemptively address and fortify areas that an attacker might exploit. A proactive approach like this is vital for transitioning from a reactive to an aggressive stance in cybersecurity defense.

At a glance, it might seem that the visibility necessary for security teams also leads to an overreach in access and breaking segregation of duties. This problem can be addressed by implementing stringent governance mechanisms. These should include regular audits, role-based access controls, and strict oversight to maintain checks and balances.

By adopting an iterative process that respects the principles of least privilege and privacy, organizations can gradually expand their understanding of the attack surface in a controlled and secure manner, thus avoiding the pitfalls of an overly broad or intrusive approach.

Spotting easy targets

Cybercriminals often employ strategies akin to natural predators, seeking out the weakest and most vulnerable targets first. This efficient approach to hunting allows them to exploit the most accessible vulnerabilities with minimal effort. These ‘easy targets’ often include outdated systems, predictable passwords, hardcoded secrets, and other overlooked security gaps within an IT environment. Attackers view these weaknesses as ‘low-hanging fruit,’ making them the first point of attack in their strategy.

However, this focus on easily exploitable vulnerabilities does not preclude them from attempting more complex and esoteric attacks. Understanding this predatory behavior is required for effective attack surface management, which stresses the importance of identifying and securing these apparent yet often neglected vulnerabilities. Organizations can prioritize these weaknesses to prevent attackers from gaining an easy foothold within their systems.

Recognizing and addressing common vulnerabilities forms the cornerstone of this proactive defense approach. Vigilance is indispensable in identifying weaknesses that attackers often exploit, including unpatched software, systems with default configurations, and weak authentication mechanisms. These vulnerabilities can provide easy access points for attackers to infiltrate and compromise systems if left unchecked.

Regular vulnerability scans and security assessments become foundational tools in the arsenal of ASM. These scans and assessments allow organizations to stay one step ahead, identifying and mitigating these ‘easy targets’ before attackers can leverage them. The threat landscape is continuously evolving. This constant vigilance of feeding vulnerability back into the attack surface evaluation process is indispensable for ensuring the ongoing security and resilience of an organization’s IT infrastructure against new and emerging threats.

Keep your eyes on the prize

Prioritizing mission-critical assets is paramount. Attackers often understand which data or assets within an organization are most valuable, targeting these for maximum impact. Aligning with this understanding, ASM emphasizes the importance of identifying and prioritizing the protection of these important assets. This strategic prioritization is key, ensuring that the assets most vital to an organization’s operations and success receive the highest security attention. By doing so, organizations can allocate their resources more effectively, ensuring that their most sensitive and valuable assets are shielded from the most probable and damaging threats.

The process of asset criticality analysis plays a significant role in this strategic approach. It thoroughly evaluates which assets are integral to the organization’s core functions and operations. This analysis considers factors such as the importance of the asset to business operations, the sensitivity of the data it holds, and the potential impact on the organization should the asset be compromised. It also factors in which devices represent the most risk or could cause the most damage if misused accounting for insider threats of all varieties.

Once these high-priority assets are identified, it is imperative to implement a layered defense strategy, or defense in depth, around them. An example is using a combination of firewalls and an intrusion detection system to generate alerts if someone bypasses the firewall. The goal is to use multiple security measures to protect these assets so that even if one defense layer is breached, others are in place to continue the protection.

It is important to note that critical or mission critical systems are not the only things addressed as all other assets are ignored. An approach like that would be akin to placing all the guards at a castle’s front door while leaving the cellar door unattended. Its more that they are prioritized, giving them more of the limited resources available.

Across the organization, baseline standards will still need to be upheld and these help reduce the attack surface holistically. Each door to the outside may have locks and a guard, but the front gate will also have reinforcements. By taking this approach there is still some security in place, but our focus is on the most likely targets.

Adapt and overcome

The landscape of cyber threats constantly evolves, with attackers continually crafting new tactics and strategies to breach defenses. We need to do the same as defenders. In this environment, vigilance becomes more than a practice; it is necessary. ASM is fundamentally about maintaining an ongoing state of alertness, closely monitoring for emerging vulnerabilities, and being prepared to adapt defense mechanisms to mitigate novel attacks rapidly. This continuous adaptation process is beneficial and essential for avoiding potential threats. It involves an understanding that what works today may not be effective tomorrow.

Adapting to evolving threats requires a two-fold approach: staying informed on the threat landscape and developing a flexible and agile security posture. Staying informed means keeping abreast of the latest threat intelligence, which can shed light on emerging threat vectors and the tactics, techniques, and procedures (TTPs) used by attackers. This knowledge is invaluable for anticipating potential attack scenarios and preparing defenses accordingly.

On the other hand, developing a flexible and agile security posture is about building a security strategy that can quickly and efficiently adapt to new information about potential threats and vulnerabilities. This includes having the capability to swiftly reconfigure systems, implement new security controls, and adjust policies as the threat environment changes. It’s about creating a security framework that is not rigid but is robust enough to withstand current threats while being adaptable enough to evolve with future challenges.

Proactive Strategy: Playing Attacker

Adopting an attacker’s mindset involves asking, “How would I attack if I were the adversary?” This approach allows security professionals to anticipate potential attack methods, think creatively about vulnerabilities, and develop more effective defense strategies. By understanding the attacker’s logic and potential targets, ASM transforms the approach to cybersecurity from reactive to proactive, ensuring that defenses are robust and strategically focused on the most probable threats.

ASM reframes cybersecurity strategy by combining defensive tactics with an offensive mindset. This perspective empowers organizations to think like attackers, anticipate their moves, and build more resilient and proactive defense systems, ultimately leading to a more secure and robust IT environment.

Threat-hunting strategies such as Atomic Red Team and Project Mordor build on using the attacker’s mindset. These valuable tools enable organizations to proactively identify and mitigate potential security vulnerabilities. Atomic Red Team lets security teams execute specific, targeted attacks (atomics) against their systems to test and improve the effectiveness of their defensive mechanisms in real-time. This helps ensure that security measures are robust enough to thwart attack scenarios.

Similarly, Project Mordor provides pre-recorded, realistic attack scenarios based on observed threats, allowing organizations to simulate complete attack lifecycles. This not only tests the resilience of current security postures but also aids in effectively training security teams to recognize and respond to complex, multi-stage threats.

ASM Use Cases and Security Challenges

Attack Surface Management is a multifaceted solution to various organizational challenges, addressing multiple use cases through a single, robust program. By implementing ASM, organizations can simultaneously tackle various issues that pertain to their cybersecurity posture. This includes enhancing the visibility of network assets, identifying and mitigating vulnerabilities, ensuring compliance with regulatory standards, and improving overall security resilience. ASM’s comprehensive approach not only streamlines the process of managing the security of an organization’s network but also ensures that multiple problems, such as weak points in the network, compliance risks, and potential attack vectors, are addressed concurrently. Modern infrastructure is too large and scales too rapidly for traditional security practices to be effective. Attack surface management is designed to help organizations gain control of these environments and effectively manage risk with the teams’ existing staffing, not the ones they want or wish they could afford.

Visibility Challenges

One of the most significant challenges addressed by attack surface management is visibility challenges due to the complexity of modern infrastructures. Gone are the days when an organization’s infrastructure was confined to a data center. The widespread adoption of cloud infrastructure, virtualization, and Software as a Service (SaaS) products has dispersed data across various platforms, often outside the organization’s direct control. This dispersion reduces control over data and often comes with inadequate native tools for visibility.

Traditional tools designed for on-premises environments struggle to adapt to these new, dispersed environments. Moreover, even when a tool performs well outside the traditional data center in a specific environment, it often cannot interoperate with other tools to create a unified view of all organizational assets and data. The result is a fragmented and incomplete picture of the organization’s attack surface, leaving dangerous gaps in visibility and increasing the risk of security breaches.

ASM practices help organizations surpass the limitations of traditional tools, offering capabilities tailored to manage the complexities of modern, distributed infrastructures. By integrating various data sources and providing insights across different environments — whether on-premises, in the cloud, or a hybrid of both — ASM helps bridge the gap in visibility. They enable organizations to map out and understand their entire attack surface, regardless of where their data and assets are located. This comprehensive visibility is necessary for identifying hidden vulnerabilities, monitoring emerging threats, and ensuring consistent security practices across all segments of the IT infrastructure.

Asset Management

One practice ASM is intrinsically linked to is Asset Management. Within ASM, continuous asset discovery and change awareness are indispensable, as they involve regularly identifying and tracking new and existing assets within an organization’s network. This process ensures that the security management remains up-to-date and responsive to the ever-evolving IT landscape.

The categorization and monitoring of assets within ASM is a vital step involving classifying assets based on their type, importance, and potential risk. This categorization is key to prioritizing security efforts effectively and allocating resources where they are most needed. ASM also encompasses Dynamic Risk Assessment and Prioritization, a process that continuously evaluates and ranks assets based on their susceptibility to threats and their significance to business operations. Lastly, Vulnerability Identification is a cornerstone of ASM, focusing on systematically detecting weaknesses or flaws in assets that could be targeted for cyber threats.

Asset Intelligence

In Asset Intelligence, ASM extends and enhances traditional asset management approaches. With ASM, Asset Intelligence goes beyond mere discovery and monitoring; it involves integrating contextual information about each asset within an organization’s network. This includes understanding an asset’s role, its configuration settings, how it connects and interacts with other assets, and its dependencies within the broader network architecture. By incorporating these layers of context, ASM provides a deeper, more nuanced understanding of each asset, enabling more precise and effective management of the attack surface. This approach is vital for identifying potential vulnerabilities and interdependencies that might not be apparent in a standard asset management framework.

Shadow IT

One of the major challenges that organizations face with their IT infrastructure is tracking the numerous IT assets that were not purchased and set up as a part of the standard IT process. In some cases these assets are temporary systems created to facilitate a project, but not disposed of properly, leaving behind residual tech debt to address at a later time. This zombie IT persists for long periods un-managed creating easy attack surfaces. Alternatively it might come as rogue IT such as SaaS solutions purchased and run by a department on their own.

No matter what the variety is, shadow IT creates attack surfaces that are not tracked or managed, leaving the organization exposed for extended periods of time. In many cases, this exposure can last well through an incident, with the company only finding out about a breach, after being notified by a third party.

In discovering exposures, ASM is particularly valuable in identifying and managing risks associated with Shadow IT (which we will discuss in more detail in chapter 4), legacy systems, and dynamic cloud environments. With ASM, discovering exposure involves locating unmanaged, outdated, or abandoned systems within a network that may pose significant security risks due to their lack of regular maintenance and monitoring.

Additionally, ASM is instrumental in maintaining visibility in dynamic cloud environments, a critical aspect given cloud-based platforms’ fluid and scalable nature. By providing comprehensive coverage and continuous monitoring of these environments, ASM ensures that all assets, regardless of location or complexity, are accounted for and secured. This thorough approach to discovering and managing exposure is vital for organizations to maintain a robust and resilient cybersecurity posture, especially to handle the increasingly diverse and distributed IT infrastructures.

Managing Risk

ASM helps organizations effectively reduce and understand cybersecurity risks. It provides a contextual risk understanding, allowing organizations to evaluate risks based on their relevance and potential impact on business operations. This assessment is pivotal in discerning which risks pose the greatest threat to the organization’s assets and objectives. ASM’s focus on significant risks involves prioritizing various security alerts and information to help concentrate efforts on mitigating the most impactful threats, thereby optimizing resource allocation and response efficacy.

Further enhancing risk management is the use of proactive threat detection in ASM. It leverages strategies and tools to identify potential threats before they evolve into full-scale attacks. This proactive approach in ASM ensures that organizations are not just reactive to threats but are steps ahead in anticipating and neutralizing potential cybersecurity risks.

Keeping pace with a dynamic threat landscape

The rapid pace of change in contemporary IT environments is significantly accelerated by widespread cloud adoption. Over the last few years, the speed at which developers can create and implement new software functionality has drastically increased. Changes that once took weeks or months can now be executed in a matter of days. This accelerated pace of development and implementation, while advantageous in terms of efficiency and innovation, often surpasses the capabilities of traditional application security measures. Existing security processes, designed for slower development cycles, struggle to keep up with this rapid pace, leaving potential security gaps as new software is deployed or updated.

ASM plays a crucial role in enabling organizations to adapt to this accelerated pace of change. By providing a comprehensive and up-to-date view of the attack surface, ASM helps organizations identify and target the areas most impacted by these rapid changes. This focus is imperative, as these are the areas where vulnerabilities are most likely to arise and have the highest impact. ASM equips organizations with the agility to swiftly identify and address these emerging vulnerabilities, ensuring that security measures evolve with the IT environment.

Prioritization of risks

ASM is a significant benefit in the complex task of risk prioritization, especially in the modern landscape of advanced security tooling. These tools empower organizations to detect various vulnerabilities across their networks, systems, and applications, offering an unparalleled breadth of cybersecurity insight. While this enhanced detection capability results in a substantial influx of data and potential security risks, ASM turns this challenge into an advantage. It equips security teams with the ability to efficiently sift through this deluge of alerts, enabling them to identify and prioritize the most dangerous vulnerabilities effectively. This prioritization is foundational, as it ensures that the most significant threats are addressed first and with the appropriate resources, thereby optimizing the organization’s response to potential security incidents.

Prioritizing risks has become an increasingly complex yet necessary task, particularly in light of the advancements in security tooling. These advanced tools enable organizations to detect a vast and varied array of vulnerabilities across their networks, systems, and applications. While this heightened detection capability is undeniably beneficial, it also brings a deluge of data concerning potential security risks. This influx can often be overwhelming, leading to an environment where security teams are inundated with alerts. This scenario poses a significant challenge: discerning which vulnerabilities represent the most substantial threat and determining the order in which they should be addressed.

The sheer volume of detected vulnerabilities can lead to more serious threats being lost in the noise of less significant issues. As a result, the ability to effectively prioritize risks is paramount. It requires an understanding of the technical aspects of each vulnerability and a keen awareness of their potential impact on the organization’s broader operations and objectives. This prioritization ensures that the most impactful vulnerabilities are addressed promptly, mitigating the risk of significant breaches or disruptions to the organization’s core functions. Consequently, the role of security teams evolves from merely responding to alerts to strategically managing risk based on a comprehensive understanding of the cyber threat landscape and the organization’s unique vulnerabilities.

With all these discovered vulnerabilities, organizations face a bigger challenge of managing prioritization based on risk, which we will delve into deeper in chapter five. Effective prioritization of risks is not only about identifying the most significant threats but also about aligning the response to these threats with the organization’s available resources. This includes considering the availability of technical staff, understanding budgetary limitations, and assessing the feasibility of implementing specific security measures. By prioritizing risks in the context of these resource constraints, organizations can ensure a more efficient allocation of their limited resources. Such a strategic approach ensures that the most critical vulnerabilities are addressed promptly and with the appropriate level of urgency, thereby maximizing the impact of the organization’s cybersecurity efforts within the bounds of its operational capabilities.

An underlying issue is contextualizing vulnerabilities within the business operations framework to drive this prioritization. An in-depth understanding of the business context for each vulnerability is essential. This process evaluates how a specific vulnerability can affect the IT infrastructure and the broader business operations and objectives. At a high level, the fundamental factors in this assessment include:

• The criticality of the affected system to essential business functions.

• The type of data at risk (personal, financial, or sensitive corporate information).

• The potential repercussions of a security breach on the organization’s reputation and legal standing.

By contextualizing these elements, organizations can categorize vulnerabilities more accurately based on their potential impact on business operations. This enables a more strategic and focused response, ensuring that resources and efforts are directed toward mitigating risks that pose the most significant threat to the organization’s core objectives and functions.

Risks associated with mergers and acquisitions (M&A)

ASM provides significant benefits by addressing the complexities associated with the rapid expansion of the attack surface. When an organization acquires another, it gains new assets and inherits associated security risks. ASM plays a vital role in systematically assessing the security posture and potential vulnerabilities of the newly combined entity. It enables comprehensive visibility of all assets, including hardware, software, digital assets, user accounts, and data repositories, which is essential for understanding the full scope of the expanded attack surface.

ASM does not operate based on assumed open trust between enterprises. Instead, a critical preliminary step involves rigorous attack surface validation to ensure that all assets, vulnerabilities, and threats are accurately identified and assessed. This validation is essential to establish a reliable foundation for ASM. Once validated, ASM can be systematically applied to manage and mitigate risks associated with the attack surface. Establishing stringent standards for attack surface validation ensures that ASM strategies are based on accurate data and can effectively protect the organization against potential security breaches.

Using ASM effectively navigates the challenges posed by differences in security infrastructure and the presence of previously unknown or unmanaged assets. By providing a clear and thorough assessment of the attack surface post-M&A, ASM facilitates informed decision-making and strategic security planning, ensuring the organization’s expanded digital environment is secure and resilient.

Incident Response and Prioritization

ASM excels in enhancing incident response and prioritization efforts for an organization. Through ASM, there is an enhanced visibility of asset usage, allowing for a more precise and comprehensive understanding of how network assets are utilized. This visibility is crucial in spotting anomalies swiftly, which could indicate potential security threats or breaches.

Additionally, ASM aids in rapid anomaly detection, enabling organizations to quickly identify and respond to unusual activities that might signal a security breach. This rapid detection is essential for minimizing the impact of such incidents. ASM utilizes automated alerting and efficient resolution mechanisms. These systems are designed to automatically alert security teams of potential threats and streamline the response and resolution process. This automation speeds up the response time and ensures a more organized and practical approach to managing security incidents.

Resource allocation

Attack Surface Management offers a significant benefit in terms of resource allocation, despite the inherent challenges posed by limited resources. ASM’s advantage lies in its ability to facilitate strategic planning and optimize these resources. By effectively identifying and prioritizing potential risks and vulnerabilities within an organization’s IT environment, ASM enables a more focused and efficient allocation of resources. This targeted approach ensures that the most critical areas of the attack surface receive the attention and resources they require, enhancing the overall security posture with optimal resource utilization.

Investments in Infosec need to be meticulously strategized, as all budgets are inherently limited. Selecting tools and technologies that offer quantifiable value and demonstrate versatility is essential. An example are tools that are capable of scanning vulnerability in diverse environments like cloud and on-premises rather than being confined to just one area. This approach not only ensures efficiency but also maximizes the return on investment. Additionally, Infosec teams often find themselves in a competitive scenario, vying for funding against other departments within an organization. This necessitates articulating security investments’ tangible value and importance to senior leadership to secure the necessary resources.

Another significant challenge in this domain is the scarcity of qualified personnel. There is a high demand in the cybersecurity field for skilled staff, which is not met by the available supply, which leads to perpetual understaffing. Budget constraints make this situation even more complicated, as hiring sufficiently qualified personnel is costly. Consequently, organizations must focus on maximizing the productivity and efficiency of their existing staff. Overburdening team members with excessive alert investigations can detract from their ability to engage in proactive security projects that enhance the overall security posture.

The security team’s continuous training and skill development also play a pivotal role in resource allocation. Keeping up with the latest technologies and threats requires ongoing training, which demands investment of already limited resources. The advent of cloud computing is a prime example of how a lack of skills in new technologies can lead to significant security breaches, such as those resulting from misconfigured cloud services. Numerous breaches due to misconfigured S3 buckets exposing sensitive data are a stark reminder of this problem.

Security teams are constantly grappling with balancing operational security with implementing new, more robust security controls. Resources directed towards one area inevitably reduce the availability of others. This is compounded by team members’ limited weekly working hours, which must be judiciously allocated between maintaining daily operations and pursuing proactive security measures. Achieving this balance is crucial, as both aspects are integral to maintaining a secure and resilient organization.

Improved Incident Response

Attack Surface Management significantly enhances incident response by providing a detailed mapping of all potential points of ingress within an organization’s network. This comprehensive mapping includes the obvious and less apparent entry points that attackers could exploit. ASM enables organizations to implement proactive defense measures by identifying these potential vulnerabilities. These measures might involve reinforcing firewalls, applying stricter access controls, and continuously monitoring these entry points for unusual activities.

In the event of a breach, ASM’s detailed understanding of ingress points facilitates rapid identification of the breach’s origin. This swift pinpointing of the attack’s starting point is crucial for a quick and effective response, which is vital in limiting the breach’s spread and reducing its overall impact.

ASM tools provide visibility into the actions taken by attackers once they have penetrated a system. They enable organizations to track attackers’ movements within their networks and identify which data or assets have been accessed or compromised. This tracking is pivotal in assessing the full scope of an incident. With ASM, organizations can more accurately determine the severity of a breach and the necessary steps for containment and remediation.

The insights gained from observing attacker behavior and understanding the impact of their actions are invaluable for future security planning. These insights allow organizations to refine their ASM strategies, adapting them to better anticipate and counter future threats by understanding the motivations and methods behind attacks on specific areas of their network.

Policy Enforcement

ASM is vital in policy enforcement, particularly in ensuring regulatory and compliance alignment within organizations. With the complexities of modern cybersecurity, adhering to various legal and regulatory standards is not just mandatory but essential for maintaining organizational integrity and trust. ASM facilitates this alignment by providing a framework through which organizations can ensure that their operations, particularly IT and cybersecurity, comply with the necessary legal and regulatory requirements.

Compliance and regulatory pressures

Effective ASM helps the organization align with legal, regulatory, and internal data handling and protection rules. Compliance and regulatory requirements are about adhering to laws and protecting the organization from potential breaches and their consequences. ASM gives organizations visibility and understanding of how their data is exposed, allowing them to tailor controls to meet a wide range of industry and governmental requirements.

• Internal Governance: In the context of cybersecurity, this refers to the set of policies, procedures, and controls an organization establishes to effectively manage its operations and associated risks. This aspect of governance is crucial in determining how cybersecurity risks are identified, assessed, and mitigated. Effective internal governance requires a clear understanding of the organization’s risk appetite, which guides the development of robust cybersecurity policies.

• External Regulations (HIPAA, SOX, GDPR, etc): Compliance with external regulations is critical to an organization’s cybersecurity strategy. Laws such as the Health Insurance Portability and Accountability Act (HIPAA), the Sarbanes-Oxley Act (SOX), and the General Data Protection Regulation (GDPR) set specific cybersecurity requirements for organizations. HIPAA, for instance, is focused on safeguarding patient health information. At the same time, SOX is concerned with the integrity of financial data, and GDPR emphasizes protecting personal data rights within the European Union. Compliance with these regulations is mandatory, and failure to adhere can lead to significant monetary penalties, legal consequences, and reputational damage. Understanding the nuances of each law that applies to your organization helps in tailoring your cybersecurity strategies to ensure compliance and avoid the potential ramifications of non-compliance.

• Industry Mandates: In addition to general regulatory requirements, certain industries are subject to specific mandates that dictate cybersecurity standards. For instance, the Payment Card Industry Data Security Standard (PCI-DSS) is crucial for organizations handling credit card transactions. At the same time, Service Organization Control 2 (SOC2) is pertinent for service providers, and the ISO 27001 standard is vital for information security management. These industry mandates offer a structured framework for cybersecurity best practices and typically require organizations to undergo regular reporting and compliance audits. Adhering to these mandates is more than just meeting regulatory requirements; it also plays a significant role in building and maintaining trust with customers and partners. Demonstrating a commitment to rigorous cybersecurity standards through compliance with these industry-specific mandates reflects an organization’s dedication to protecting its own data and that of its clients and stakeholders.

Compliance is further strengthened by ASM’s role in improving reporting and documentation. By maintaining detailed records and generating comprehensive reports, ASM supports transparency and accountability in cybersecurity practices. These records and reports are crucial for demonstrating compliance during audits and reviews, and they also serve as invaluable resources for the continual improvement of security practices.

Summary

After reading this chapter, you should now have a better understanding of attack surface management and the fundamental role it plays in cybersecurity. Starting with a clear definition of ASM, we explored the comprehensive nature of an organization’s attack surface, which includes physical hardware, software systems, and human elements that interact with these technologies.

As organizations increasingly incorporate advanced technologies like cloud computing, IoT, and AI into their infrastructures, the complexity and scope of their attack surfaces expand, introducing unique security challenges. ASM is your ongoing proactive defense against emerging threats, adapting as technology and risks change to preemptively address threats before they can exploit these surfaces.

Next, let’s dive a bit deeper, exploring more on the specific types of attack surfaces. We’ll discuss how the attack surfaces have evolved from traditional environments to today’s modern and expanding IT ecosystem. We’ll dig into how each component, from legacy systems to advanced cloud solutions, contributes to the organizational attack surface, and how that has given rise to a need for tailored security strategies that address the unique challenges posed by these diverse elements. By understanding the specifics of each type of attack surface, you are better prepared to tackle the security complexities within your organization’s diverse environment.