The attack surface of organizations is nowadays more complex than ever.
As more and more businesses increase the number of their digital assets and incorporate new technology to operate, they turn their attack surface into an intricate network.
Securing all the systems that include remote employees’ endpoint devices and multi-cloud environments has been a challenge.
Cybersecurity teams also have to keep pace with exposed business intelligence and information that could be used for the cyberattack, freely available online.
Attack Surface Management (ASM) is the tool that scans for leaked assets that could turn into incidents.
How is ASM used to protect companies and how best to communicate with CEOs and teams in the company to weed out leaked corporate intelligence at its root?
Following Three Phases of the Attack Surface Management
Attack Surface Management has three stages that are continually repeated — discovery, analysis, and mitigation.
The initial discovery phase includes scanning for any digital assets or exploitable corporate intelligence. During the reconnaissance, ASM seeks any shadow IT, leaked credentials, or data available online that could be used for phishing attacks.
To bring the exposed data and assets into the light, the tool acts like a cybercriminal, scanning for vulnerabilities within the organization’s infrastructure as well as intelligence that is available online.
The discovery is followed by the analysis of the data that is revealed during the reconnaissance phase. The classification phase of the ASM is all about determining the severity of businesses’ exposure.
High-risk threats, such as misconfigurations, are separated from the previously gathered information. Exploitable intelligence is cataloged for a clear overview of the existing assets.
The generated report will reveal the gravity of the risk and which uncovered intelligence and assets should be handled before everything else. Some companies also include an interactive dashboard that shows all the ASM discoveries in one place.
Mitigation is the third stage of ASM that involves patching up the gaps in the security and replacing security control with different vectors (if necessary).
It’s often not possible to remove or retrieve assets that have been exposed on hacking forums, dark web, or the internet.
Teams can focus on strengthening security controls, changing emails and passwords that have been leaked, adding new security tools, and fixing errors such as misconfigured tools.
The three steps are continually repeated and automated for security teams. In that way, ASM takes a lot of legwork from them by scanning the attack surface and highlighting the top high-risk assets that could lead to incidents in the company.
Continuity also ensures that the system is protected against the latest methods depicted in the MITRE ATT&CK Framework.
Focusing on External Attack Surface Management
Leaked corporate intelligence available online has been the blind spot of Firewalls, anti-malware, and endpoint detection and response (EDR).
Therefore, besides the internal infrastructure and services that can be found on the top of the businesses’ infrastructure, special attention has to be paid to the data that is circulating on the network as well as the internet.
Sensitive data leaks can lead to cyber breaches and significantly damage a company’s funds as well as reputation. Many of whom never recover.
The majority of this data is available online, and teams have been focusing on addressing internet-facing intelligence and assets to discover them before cybercriminals do.
Attack Surface Management has been designed to scour the web for leaked intelligence and includes the discoveries in the generated report that is updated for the latest discoveries.
Discussing Attack Surface Management with Businesses
Companies extensively invest in cybersecurity and understand the repercussions of unsecured data and assets.
One thing that is worth keeping in mind when conversing with board members is that they get a majority of their information about security in magazines that cover breaches and the latest technological developments.
Full coverage and protection of the organization’s attack surface might include having to broaden the company’s understanding of its major attack vector — without going too deep into the technicalities.
How should you discuss the security with the CEOs and board of directors that hired you to protect their assets?
They want to save on operating costs and ensure that their app is safe enough to be released and that their system doesn’t have vulnerabilities that could lead to expensive data breaches.
Be honest and help them understand that they might need to halt the app release, or invest in cybersecurity training for their employees.
Developing Healthy Cybersecurity Culture
Culprits of leaked data are often employees that don’t know a lot about cybersecurity. Less tech-savvy employees are likely to fall victim to social engineering attacks or reveal their or company’s data to a threat actor accidentally.
While they might have been through some basic training on cybersecurity in theory, they may not recognize they’re creating a security risk in practice.
Even those that might recognize that they’ve put the company at risk, are reluctant to reveal it, from fear of repercussions.
Work on creating a safe space and a cyber culture that enables them to report if they possibly exposed the company’s assets or maybe even called for the phishing scam in the email.
Most employees aren’t responsible for security management in the organization and don’t have the same level of responsibility for keeping data safe like companies and IT teams.
Regardless of that, they still can help with strengthening the security, and they’re likely to be the primary target of social engineering attacks.
To Conclude
Attack Surface Management is a tool that continually scans for digital assets that could lead to damaging cyber breaches and major data loss.
To deal with the issue of unsecured assets, it’s necessary to leverage the employees that are working in the company and use the right tools to decide on the next steps in security.
Cybersecurity is dynamic and ever-changing and the accessibility of employee data and possible leaked data on the web complicated the security management.
