What is Attack Surface Management? – IBM

ASM consists of four core processes: Asset discovery, classification and prioritization, remediation, and monitoring. Again, because the size and shape of the digital attack surface changes constantly, the processes are carried out continuously, and ASM solutions automate these processes whenever possible. The goal is to ensure that the security team always has complete and current inventory of exposed assets, and to accelerate response to the vulnerabilities and threats that present the greatest risk to the organization.

Asset discovery

Asset discovery automatically and continuously scans for and identifies internet-facing hardware, software, and cloud assets that could act as entry points for a hacker or cybercriminal trying to attack an organization. These assets can include

• Known assets—all IT infrastructure and resources the organization is aware of and actively managing—routers, servers, company-issued or privately-owned devices (PCs, laptops, mobile devices), IoT devices, user directories, applications deployed on premises and in the cloud, web sites, and proprietary databases.
• Unknown assets—‘uninventoried’ assets using network resources without the IT or security team’s knowledge. Shadow IT—hardware or software deployed on the network without official administrative approval and/or oversight—is the most common type of unknown asset. A free font downloaded to a user‘s computer, personal web sites or cloud applications used via the organization’s network, and an unmanaged personal mobile device used to access company information are all examples of shadow IT. Orphaned IT—old software, web sites and devices no longer in use that have not been properly retired—are another common type of unknown asset.
• Third-part or vendor assets—assets the organization doesn’t own, but that are part of the organizations IT infrastructure or digital supply chain. These include software-as-a-service (SaaS) applications, APIs, public cloud assets, or third-party services used within the organization’s web site.
• Subsidiary assets—any known, unknown or third-party assets belonging to networks of an organization’s subsidiary companies. Following a merger or acquisition, these assets may not immediately come to the attention of the IT and security teams of the parent organization.
• Malicious or rogue assets—assets created or stolen by threat actors to target the company. This can include a phishing web site impersonating a company’s brand, or sensitive data stolen as part of a data breach being shared on the dark web.

Classification, analysis and prioritization

Once assets are identified, they are classified, analyzed for vulnerabilities, and prioritized by ‘attackability‘—essentially an objective measure of how likely hackers are to target them.

Assets are inventoried by identity, IP address, ownership, and connections to the other assets in the IT infrastructure. They’re analyzed for the exposures they might have, the causes of those exposures (e.g., misconfigurations, coding errors, missing patches), and the kinds of attacks hackers may carry out through these exposures (e.g., stealing sensitive data, spreading ransomware or other malware).

Next, the vulnerabilities are prioritized for remediation. Prioritization is a risk assessment exercise: Typically, each vulnerability is given security rating or risk score based on

• information gathered during classification and analysis;
• data from threat intelligence feeds (proprietary and open source), security rating services, the dark web, and other sources regarding how visible vulnerabilities are to hackers, how easy they are to exploit, how they’ve been exploited, etc.;
• results of the organization’s own vulnerability management and security risk assessment activities. One such activity, called red teaming, is essentially penetration testing from the hacker’s point of view (and often conducted by in-house or third-party ethical hackers). Instead of testing known or suspected vulnerabilities, red teamers test all assets a hacker might try to exploit.

Remediation

Typically, vulnerabilities are remediated in order of priority. This can involve:

• Applying appropriate security controls to the asset in question-e.g., applying software or operating system patches, debugging application code, implementing stronger data encryption
• Bringing previously unknown assets under control—setting security standards for previously unmanaged IT, securely retiring orphaned IT, eliminating rogue assets, integrating subsidiary assets into the organization’s cybersecurity strategy, policies and workflows.

Remediation can also involve broader, cross-asset measures for addressing vulnerabilities, such as implementing least-privileged access or multi-factor authentication (MFA).

Monitoring

Because security risks in the organization’s attack surface change any time new assets are deployed or existing assets are deployed in new ways, both the inventoried assets of the network and the network itself are continuously monitored and scanned for vulnerabilities. Continuous monitoring enables ASM to detect and assess new vulnerabilities and attack vectors in real time, and alert security teams to any new vulnerabilities that need immediate attention.