Attack Surface Management

Chapter 3. How the Attack Surface Relates to Risk

Understanding the relationship between an organization’s attack surface and risk exposure is foundational for protecting valuable assets. This chapter explores the essential role of risk management in cybersecurity, guiding professionals through the various methods of identifying, measuring, and managing risks that endanger their organizations.

Together, we discuss qualitative and quantitative risk assessments and analyze widely used frameworks published by NIST and ISO. We’ll look at practical insights into selecting the right approach for different environments. We’ll dive into prioritizing risks based on impact and likelihood, ensuring that the most consequential vulnerabilities are addressed first. This information will equip you with the tools necessary to translate technical risks into actionable business strategies that non-technical business units can understand and act on.

Measuring Risk

Let’s begin with the concept of measuring risk. A threat is anything that has the potential to cause harm to an organization’s assets, including cyberattacks, natural disasters, internal access abuse or unintentional mistakes. Risk, on the other hand, is the possibility that a threat will exploit a vulnerability to harm an asset. Essentially, risk arises from the intersection of threats and vulnerabilities.

In ASM, we need to identify and classify assets, and then understand the various risks each one faces and the best methods to manage ...