Attack Surface Management: what it is

In short

The attack surface is everything an attacker can reach: servers and services published on the internet, subdomains, web applications, mailboxes, cloud accounts, devices on the internal network, people. Attack Surface Management keeps a complete, up-to-date list of all of it, because you cannot protect what you do not know you have.

How it works

The work repeats in a cycle:

1. discovery: you start from known facts (domain, IP addresses, company name) and look for related assets, for example subdomains registered in DNS or in public certificate logs;
2. inventory: each asset found is confirmed or discarded, and the person responsible for it knows;
3. classification: you state how much each asset matters to the business;
4. analysis: checks run on the confirmed assets, starting with vulnerability assessment;
5. monitoring: discovery starts again, because the surface changes every week.

When the focus is on the part visible from the internet, it is also called EASM (External Attack Surface Management).

Why it matters

Many incidents start from something nobody remembered exposing: a test environment left running, an old site from a marketing campaign, an administration panel published for convenience by a supplier. A vulnerability assessment analyses in depth whatever you point it at; ASM decides what to point it at. Without the second, the first works on an incomplete perimeter.

There is also a question of priority: knowing that one asset is the production management system and another a static page changes the order in which you tackle findings with the same CVSS score.

Example

An engineering company registers its website and email. Automatic discovery also finds test.companyname.it, created years earlier by a web agency to try out a site update: it is still online, with a CMS that has never been updated and a reachable login panel. Nobody considered it part of the company, but to an attacker it is. The subdomain is switched off and, from then on, every newly discovered subdomain arrives as a proposal to review.

For an overview of how to set up these checks in a small business, see cyber security for SMEs.

Related terms

• Vulnerability assessment
• Dark web: exposed credentials are part of the surface too
• Hardening
• Supply chain attack