Attack surface management (ASM) is the continuous discovery, analysis, remediation and monitoring of the cybersecurity vulnerabilities and potential attack vectors that make up an organization’s attack surface.

Unlike other cybersecurity disciplines, ASM is conducted entirely from a hacker’s perspective, rather than the perspective of the defender. It identifies targets and assesses risks based on the opportunities they present to a malicious attacker. ASM relies on many of the same methods and resources that hackers use, and many ASM tasks and technologies are devised and performed by ‘ethical hackers’ familiar with cybercriminals’ behaviors and skilled at duplicating their actions.

External attack surface management (EASM), a relatively new ASM technology, is sometimes used interchangeably with ASM. But EASM focuses specifically on the vulnerabilities and risks presented by an organization’s external or internet-facing IT assets (sometimes referred to as an organization’s digital attack surface). ASM also addresses vulnerabilities in an organization’s physical and social engineering attack surfaces, such as malicious insiders or inadequate end-user training against phishing scams.

Cloud adoption, digital transformation and the expansion of remote work--all accelerated by the COVID-19 pandemic--have made the average company’s digital footprint and attack surface larger, more distributed and more dynamic, with new assets connecting to the company network daily.

According to Randori’s State of Attack Surface Management 2022 (link resides outside ibm.com) report, 67 percent of organizations have seen their attack surfaces expand in the past 12 months, and 69 percent have been compromised by an unknown or poorly managed internet-facing asset in the past year. (Randori is a subsidiary of IBM Corp.) Industry analysts at Gartner (link resides outside ibm.com) named attack surface expansion a top security and risk management priority for CISOs in 2022.

Traditional asset discovery, risk assessment and vulnerability management processes, which were developed when corporate networks were more stable and centralized, can‘t keep up with the speed at which new vulnerabilities and attack vectors arise in today's networks. Penetration testing, for example, can test for suspected vulnerabilities in known assets, but it can’t help security teams identify new cyber risks and vulnerabilities that arise daily.

But ASM‘s continuous workflow and hacker’s perspective enable security teams and security operations centers (SOCs) to establish a proactive security posture in the face of a constantly growing and morphing attack surface. ASM solutions provide real-time visibility into vulnerabilities and attack vectors as they emerge. They can draw on information from traditional risk assessment and vulnerability management tools and processes for greater context when analyzing and prioritizing vulnerabilities. And they can integrate with threat detection and response technologies—including security information and event management (SIEM), endpoint detection and response (EDR) or extended detection and response (XDR)—to improve threat mitigation and accelerate threat response enterprise-wide.

ASM consists of four core processes: Asset discovery, classification and prioritization, remediation, and monitoring. Again, because the size and shape of the digital attack surface changes constantly, the processes are carried out continuously, and ASM solutions automate these processes whenever possible. The goal is to ensure that the security team always has complete and current inventory of exposed assets, and to accelerate response to the vulnerabilities and threats that present the greatest risk to the organization.

Asset discovery

Asset discovery automatically and continuously scans for and identifies internet-facing hardware, software, and cloud assets that could act as entry points for a hacker or cybercriminal trying to attack an organization. These assets can include

• Known assets—all IT infrastructure and resources the organization is aware of and actively managing—routers, servers, company-issued or privately-owned devices (PCs, laptops, mobile devices), IoT devices, user directories, applications deployed on premises and in the cloud, web sites, and proprietary databases.
  
  
• Unknown assets—‘uninventoried’ assets using network resources without the IT or security team’s knowledge. Shadow IT—hardware or software deployed on the network without official administrative approval and/or oversight—is the most common type of unknown asset. A free font downloaded to a user‘s computer, personal web sites or cloud applications used via the organization’s network, and an unmanaged personal mobile device used to access company information are all examples of shadow IT. Orphaned IT—old software, web sites and devices no longer in use that have not been properly retired—are another common type of unknown asset.
  
  
• Third-part or vendor assets—assets the organization doesn’t own, but that are part of the organizations IT infrastructure or digital supply chain. These include software-as-a-service (SaaS) applications, APIs, public cloud assets, or third-party services used within the organization’s web site.
  
  
• Subsidiary assets—any known, unknown or third-party assets belonging to networks of an organization’s subsidiary companies. Following a merger or acquisition, these assets may not immediately come to the attention of the IT and security teams of the parent organization.
  
  
• Malicious or rogue assets—assets created or stolen by threat actors to target the company. This can include a phishing web site impersonating a company’s brand, or sensitive data stolen as part of a data breach being shared on the dark web.

Classification, analysis and prioritization

Once assets are identified, they are classified, analyzed for vulnerabilities, and prioritized by ‘attackability‘—essentially an objective measure of how likely hackers are to target them.

Assets are inventoried by identity, IP address, ownership, and connections to the other assets in the IT infrastructure. They’re analyzed for the exposures they might have, the causes of those exposures (e.g., misconfigurations, coding errors, missing patches), and the kinds of attacks hackers may carry out through these exposures (e.g., stealing sensitive data, spreading ransomware or other malware). 

Next, the vulnerabilities are prioritized for remediation. Prioritization is a risk assessment exercise: Typically, each vulnerability is given security rating or risk score based on

• information gathered during classification and analysis;
  
  
• data from threat intelligence feeds (proprietary and open source), security rating services, the dark web, and other sources regarding how visible vulnerabilities are to hackers, how easy they are to exploit, how they’ve been exploited, etc.;
  
  
• results of the organization’s own vulnerability management and security risk assessment activities. One such activity, called red teaming, is essentially penetration testing from the hacker’s point of view (and often conducted by in-house or third-party ethical hackers). Instead of testing known or suspected vulnerabilities, red teamers test all assets a hacker might try to exploit.

Remediation

Typically, vulnerabilities are remediated in order of priority. This can involve:

• Applying appropriate security controls to the asset in question--e.g., applying software or operating system patches, debugging application code, implementing stronger data encryption
  
  
• Bringing previously unknown assets under control—setting security standards for previously unmanaged IT, securely retiring orphaned IT, eliminating rogue assets, integrating subsidiary assets into the organization’s cybersecurity strategy, policies and workflows.

Remediation can also involve broader, cross-asset measures for addressing vulnerabilities, such as implementing least-privileged access or multi-factor authentication (MFA).

Monitoring

Because security risks in the organization's attack surface change any time new assets are deployed or existing assets are deployed in new ways, both the inventoried assets of the network and the network itself are continuously monitored and scanned for vulnerabilities. Continuous monitoring enables ASM to detect and assess new vulnerabilities and attack vectors in real time, and alert security teams to any new vulnerabilities that need immediate attention.