84%
Business, IT, and security managers that say that cyber-risk is greater than it was two years ago
Now Available - Forrester Report: The Total Economic Impact™ Of The CyCognito Platform
Solutions
Skip to main content
Attack surface management is the continuous process of discovering, classifying and assessing the security of all of an organization’s assets. With the rush to digital transformation, your attack surface has both grown exponentially and become immeasurably harder to define and defend. Add to that the rise in cyberattacks and breaches, and it’s no wonder that there is a spotlight on attack surface management.
— Alex Schuchman | Chief Information Security Officer, Colgate-Palmolive Company 
Item 1 of Infinity
Attack Surface Management
Understanding Attack Surface Management
The key to protecting your organization and preventing cyberattacks
Attack surface management is the continuous process of discovering, classifying and assessing the security of all of an organization’s assets. With the rush to digital transformation, your attack surface has both grown exponentially and become immeasurably harder to define and defend. Add to that the rise in cyberattacks and breaches, and it’s no wonder that there is a spotlight on attack surface management.
What is an Attack Surface?
First, it’s important to understand what we mean when we talk about the attack surface. An attack surface is the sum of an organization’s attacker-exposed IT assets, whether these digital assets are secure or vulnerable, known or unknown, in active use or not, and regardless of IT or security team awareness of them. An organization’s attack surface changes continuously over time, and includes digital assets that are on-premises, in the cloud, and in subsidiary networks, as well as those in third-party vendors' environments.
CyCognito provides our company with cutting-edge technology enabling my team to have global visibility into all our web-facing assets in an easy-to-use interface, and it does so better than other attack surface management tools we've used."
What is Attack Surface Management?
Now that we’ve defined what attack surface means, what does it mean to say you are engaging in attack surface management? It’s a process that enables you to continuously discover, classify and assess the security of your IT ecosystem. The process can be broadly divided into two categories:
- Activities performed in managing internet-exposed assets (a process called external attack surface management, or EASM)
- Management activities on assets accessible only from within an organization
68%
Organizations that have experienced a cyber attack that began from an unknown, unmanaged, or poorly-managed company asset
75%
Believe that they will experience this type of cyber attack again
Why Is Attack Surface Management Important?
You don’t have to look far to find stories about the danger of ever-growing attack surfaces. Take the SolarWinds attacks in which malware was introduced via organizations’ supply chains, routes that are often overlooked on the assumption that they are implicitly secure. This exploit continues to turn up victims, including the email systems of government and international aid agencies that have been critical of the alleged perpetrators.
Another oft-forgotten attack vector is out-of-date software and hardware that is still in use, such as the exploited remote code execution vulnerabilities that have existed on Microsoft Exchange servers as far back as 2010. Remote code execution vulnerabilities were also exploited in attacks against Accellion customers using the company’s legacy File Transfer Appliance (FTA).
Ransomware, as demonstrated by the recent Colonial Pipeline attack, is another example. The attack targeted remote services such as Citrix, Remote Desktop Web (RDWeb), or remote desktop protocol (RDP) to initially gain unauthorized access. Because organizations are working with largely-remote workforces due to the pandemic, the timing couldn’t have been worse.
In each of these breaches, attackers made their way in through a route that was either unknown by security or considered unimportant. Given the vast number of devices and services spanning your enterprise, it is easy to see how something could be overlooked, especially if you are examining your attack surface from the perspective of most security teams– that is to say, the inside out.
BUT THAT’S NOT HOW ATTACKERS THINK.
Today’s sophisticated attacks involve extensive, automated reconnaissance efforts that analyze your attack surface from the outside in. This perspective often reveals a completely different picture of the only attack surface that matters – the one attackers can exploit.
The only way to effectively defend against attacks is to take an attack surface management approach that provides the same continuous visibility into your security gaps as attackers have – outside in – so you can remediate issues before they become exploited.
How does attack surface management protect from cyberattacks?
Effective attack surface management is a continuous, five-step process used to keep your organization up-to-date with the most important attack vectors.
Attack Surface Protection with CyCognito
When you are ready to go beyond legacy systems to manage your cybersecurity risks, the CyCognito attack surface management platform can help elevate your continuous discovery, testing and vulnerability management. It preempts cyber attacks like ransomware and others and helps satisfy key elements of most common security frameworks and many regulatory compliance standards. The platform achieves this by discovering and testing your entire digital attack surface, prioritizing what needs to be fixed first, integrating with and orchestrating existing workflows, and automatically validating remediation.