In 2020, Capital One was fined $80 million when a cloud misconfiguration resulted in the theft of personal data from 106 million customers. In 2018, Amazon S3 (cloud storage service) was responsible for around 30% of all records exposed, which led to high-profile breaches of the U.S. Department of Defense, Dow Jones & Co., Verizon Wireless, and Booz Allen Hamilton.
These organizations fell victim to vulnerabilities that were discovered by attackers within the organizations’ attack surfaces. As technology has become more sophisticated, so have threat actors and the tactics used to take advantage of weaknesses. The evolution of workplace structures and the proliferation of the cloud has complicated and magnified the need for advanced cybersecurity protocols.
Headed to RSA? GET YOUR CUSTOM ATTACK SURFACE ANALYSIS THERE!
The internet is vast — how can organizations be aware of all possible points of exposure and weakness, including unknown assets? Those areas of vulnerability make up your attack surface, and performing thorough attack surface analysis is crucial for enterprise businesses, especially today.
In this blog, we’ll define what exactly the attack surface is, how it can be exploited, and the impact it has on businesses and organizations.
What does the attack surface entail?
The attack surface is the number of all possible points, or attack vectors, where an unauthorized user can access a system and extract data. While the term “attack surface” has been used to refer to internal areas of an organization’s security posture, we’ll be specifically focusing on the external attack surface.
Your attack surface includes both known and unknown assets, whether they are hosted by your organization or hosted elsewhere. When exploring your attack surface analysis through attack surface management (ASM) techniques, points of weakness can include but are not limited to:
- Applications
- Hosts
- Code
- Ports
- Servers
- Software
- Cloud environments
- Websites
- Shadow IT
A particular spotlight has been placed on attack surface management in recent years, specifically in the post-pandemic world. Shifting work environments and global remote access have created a much greater priority for organizations to understand every possible weakness in their system that could be taken advantage of by unauthorized users.
Why are external attack surfaces growing?
Surprisingly, anywhere from 30-80% of a company’s attack surface is unknown to their security team. Organizations are unaware of what they have exposed on the public internet. Why is this?
One way is through simple misconfigurations or oversights. Security teams are overburdened and human; they don’t have the tools to properly track what they don’t know about. Unfortunately, those exposed internet assets can easily become low-hanging fruit for threat actors looking for an easy way in.
What are some of the reasons assets end up on the internet? Organizations can be known to:
- Neglect to take down old systems or enforce login policies on one-off applications
- Fail to patch for known software vulnerabilities
- React in a piece-meal fashion when major vulnerabilities come out
Additionally, those aforementioned (human) security teams don’t have control over any of the assets they’re responsible for securing; have no control over who brings up new assets or where they’re brought up; and are often understaffed and underwater. Additionally, the cloud is complex and increasingly distributed, with no safety net – it’s nearly impossible to tell if you’ve messed up and exposed something.
What does the attack surface mean for security teams?
The security of a business’s attack surface is the security of all company, employee, and client data. When there is a vulnerability in your attack surface, all company, employee, and client data becomes vulnerable. Because the attack surface can refer to assets that IT teams are not yet aware of and can be hosted or located anywhere on the internet, identifying all possible weaknesses can go beyond the capability of a vulnerability scanner or other security management tools.
An attack surface management (ASM) tool is a solution designed specifically to scan the entire internet and all existing environments to determine every possible vulnerability in your attack surface–including unknown assets. A subset of a comprehensive cybersecurity solution, the right ASM should integrate with existing threat intelligence technology, such as vulnerability management (VM), cloud security posture management (CSPM), cloud access security brokers (CASB), and security rating services (SRS) to fill in the gaps and create a complete attack surface analysis.
Future-proof your business with Censys Attack Surface Management
Your attack surface is growing by the minute. Simply because of the way we all operate on the internet today.
Workplace environments, global interconnectivity, and the advancement of cybercriminal techniques are continuously evolving, and it’s essential for organizations to be proactive in monitoring your internet exposure and to quickly fix problems as they arise. One of the most important steps toward a complete cybersecurity program is to understand attack surface analysis and thoroughly secure your attack surface.
Censys offers the leading Attack Surface Management solution that scans the entire internet for known and unknown assets and seamlessly integrates with existing vulnerability technology. Censys ASM fits neatly into a larger threat intelligence strategy by offering internet asset discovery and inventory, risk detection and remediation, M&A and subsidiary risk analysis, and cloud security and governance.
Want to see Attack Surface Management in action?
Request a Demo
