External Attack Surface

What is an attack surface?

Within cybersecurity, an attack surface is the sum of all potential entry points a malicious user could exploit to gain unauthorized access into a system or network. Taking this one step further, external attack surfaces include those components of a system that are accessible from outside an entity's internal network. In this article, we will examine the nature of external attack surfaces, methods for their identification, and strategies for protection against potential threats.

Managing an External Attack Surface

An organization's external-facing attack surface incorporates all network resources that are publicly available, including but not limited to websites, email servers, cloud-based services, and open network ports. This contrasts with the internal threat surface which primarily focuses on risks present within the corporation's own network.

The systematic method of identifying, documenting, monitoring, and securing an organization's publicly accessible assets is known as External Attack Surface Management (EASM). It entails persistent discovery and evaluation of components that are exposed to the internet. Rather than a single point-in-time review, EASM constitutes a continuous activity which involves keeping track of an organization's digital footprint that can evolve with software updates, infrastructure deployments, and changes in configurations. The aim behind EASM is acquiring thorough knowledge about the visible attack routes within an organization so as to proactively mitigate risks. This will improve protection against unauthorized access and possible cyber-attacks.

Attack Surface Mapping

Recognizing a company's external vulnerability landscape is vital to understanding and mitigating potential cyber risks. This process involves several elements:

1. Active Discovery

Active discovery is a common technique, though not one ThreatHarvest uses directly. Network scanning tools can be utilized to identify active ports on the perimeter of the network. Other tools such as those leveraging protocols like DNS can uncover otherwise seemingly hidden systems. Collaboration with outside cybersecurity experts to perform penetration tests and reconnaissance may assist in identifying an attack surface at a given point in time.

2. Passive Discovery

ThreatHarvest uses passive discovery only. It never scans or probes your open ports directly; it works from information that is already publicly available. A number of online platforms exist that aim to catalog publicly accessible devices and open ports found across the internet. Data may also exist on other public online sources, forums, and social networks that can reveal information about the digital footprint of an entity.

Detecting Change in the Attack Surface

The process of ongoing monitoring involves tracking and identifying changes within the attack surface. Such changes might include the creation of new subdomains or ports opened that were previously closed. Continuous monitoring solutions such as ThreatHarvest provide ongoing insights regarding potential threats and vulnerabilities. Upon detecting a change, ThreatHarvest surfaces a finding so appropriate staff can take necessary action. By monitoring these changes, organizations are capable of understanding how their external attack surface is evolving over time.