Remember your external ASM

If your organization exercise good cyber security, you’ll have great attack surface management. But have you also considered the external attack surface? If not, read on, and we’ll explain what exactly it is and how you protect and monitor it in the best possible way.

ASM: The foundational work

Before we dive into the functions of your external attack surface management, we should take a look at what attack surface management is and how you can carry it out in the best possible way.

Attack surface management (also ASM), is essentially the overview of which surfaces, and entry points a hacker can exploit. Hackers will often try to exploit any weakness or vulnerability in a system, whether it’s the software or a person. Hackers will also exploit SaaS and the different storage solutions you use – which are typically connected to the cloud as it has made file sharing a lot smoother.

Usually, the attack surface is divided into four general aspects:

• Service providers, e.g. SaaS-providers or third-party vendors.
• Unknown resources, e.g. via shadow IT where employees use websites and software that hasn’t been approved by the organization’s IT department.
• Malicious resources, e.g. typosquatted websites or phishing emails and compromised links.
• Known and trusted resources, e.g. resources and websites your organization uses on a daily basis and thus trust.

With ASM you thus manage these resources and surfaces by having multiple checkups each month. It may seem like a lot of management, only to potentially mitigate hacking attacks, however, it will always be paid off if you can avoid any major attacks on your organization.

Managing external attack surfaces

You may sit and wonder if there even are any more attack surfaces to manage if you have the foundational surfaces covered. But, as you guessed, there is.

Many organizations utilize different resources and tools to streamline and optimize their working process. Organizations often have an external-facing platform where they can promote their products and services – this is the surface you want to manage even better with external attack surface management.

The biggest difference between regular attack surface management and external attack surface management is that the EASM is publicly accessible thus everyone can see the platform. This also means that it becomes more vulnerable to cyber threats.

The internal attack surface is thus connected with the exploitation of privileges, data theft and unauthorized access. This can be employees exploiting the systems and software, but it can of course also be hackers who have gotten access to internal software. It is generally associated with internal actors and employees exploiting their position to gain access to data.

The external attack surface is a lot wider; this includes different types of hacking attacks like phishing and spreading of malware, ransomware, and brute force attacks. This is carried out by hackers or organized cyber criminals.

The importance of external attack surface management

The majority of cyber attacks happen on the external surface of organizations. With external attack surface management, you mitigate the risk of being struck by an attack from the outside – EASM makes it easier for you to focus on improving your cybersecurity when you know you have a minimal risk of being hit by an outside threat.

With EASM you i.e. protect:

• Cloud services provided to the public
• Open-source software
• Third-party vendor services
• Websites and platforms
• IoT and shadow IT – and prevent it from happening
• Integrations

It’s a long list which further means that there are a lot more surfaces and potential vulnerabilities that hackers can exploit. That is why we recommend you keep an extra eye out for these attack surfaces and do regular assessments of them.

A good EASM solution

Any organization that has a public platform has several potential weaknesses exposed in their external surfaces; this means that they furthermore have quite a lot of work to keep up in order to have a good cybersecurity implementation. Fortunately, we have many different solutions which include automation to monitor any irregular activity.

Some organizations even use AI to generate and program security tools to help their organization’s security management. This eases the work for the IT department – they should, however, still manage and control the attack surfaces once in a while and not completely let the software manage itself. One of the best things AI can help with is detecting irregularities in the software which can take a human expert a lot longer to detect. So, one of the best solutions is to let the computer and humans cooperate.

Some examples of how a list of EASM tasks can look as follows:

• Risk assessment
• Risk mitigation and control
• Plan out incident responses
• Assess external partners
• Resource allocation
• Reduction of the attack surfaces

These will typically be areas that a security controller goes through and develops as this list makes up the core of attack surface security.

The list is applicable to internal as well as external attack surface management. What distinguishes the two is as mentioned, how exposed the system and surface are. On a company website, your information is public and thus gives a user an idea of who you are as an organization. It also gives the hacker an idea of how you work and what software you use. This means that not only is the software exposed as an entry point, but the employees are as well. That is where your cybersecurity training comes in.

The best EAS protection is you

Since hackers can get an idea of who the organization is, they can pretty easily figure out who works for the organization. This gives them a chance to find employees and thus another and more vulnerable access point.

Many cyberattacks begin with human error, meaning that hackers send phishing emails to employees and do it in such a convincing manner, that they often don’t suspect anything. This way, hackers get their malware spread to company devices and thus get access to confidential information.

So, in order to prevent this, we recommend doing proper cybersecurity and awareness training so every employee acquires knowledge on how hackers do their jobs – and so that everyone can spot phishing and hacking attempts before they have a chance to affect the organization.