Blog

PREVENT

What does effective Attack Surface Management look like?

What does effective Attack Surface Management look like?Default blog imageDefault blog image
10
Jun 2021
10
Jun 2021

Effective attack surface management breaks down into four key parts:

  • Discovery
  • Assessment and prioritisation
  • Risk prevention
  • Integration

Discovery

The most important part of any attack surface management process is the discovery phase. As we’ve mentioned previously, most organizations miss as much as 30 to 50 percent of their true attack surface. This creates huge blind spots when it comes to understanding the real risks your organization is facing. In fact, we believe that something like 80% of all organizations’ cybersecurity problems exist due to blind spots in their attack surface. Eliminating those blind spots should be your core goal when setting out to discover your attack surface.

One of the biggest contributing factors to these blind spots is scoping. Organizations tend to work within a predefined scope when it comes to discovery – whether that’s within a defined IT infrastructure or a set of IP addresses that the organization uses and wants to protect.

However, the reality is that any would-be attackers out there do not care about your scope. Whether you have a vulnerability in-house, via an external supplier, or in a cloud environment; an attacker will find it and try to misuse it.

On top of this, with modern organizations having so many external dependencies, regulatory bodies are starting to insist that financial services companies look beyond the boundaries of their own networks when analysing risk.

For example, the Digital Operational Resilience of the financial sector (DORA), extends the focus of risk management to cover all external assets of the parties they have relationships with (such as fourth and fifth parties, or parties that you even don't know you have a relationship with), as well as any services and infrastructure that can impact on the organization’s day-to-day resilience.

Taking a zero-scope approach to your attack surface is therefore essential. This means that tracking down the full extent of your attack surface is not something that can be left to human endeavour. Relying on people to trace and discover your connections would be hugely expensive, time consuming, and error prone. So, a prerequisite of effective discovery is automation. AI and algorithmic-based discovery is the only way to uncover the bulk of your attack surface.

Assessment and Prioritization

Monitoring your attack surface is not a one-time, set-and-forget process because your attack surface is not static; it’s constantly evolving and changing. This means you need to be continuously monitoring it for changes, and you need to be alerted when those changes occur, so that you can decide whether or not something needs your attention. This data needs to be dynamic and as close to real-time as you can get.Only once you know what your full attack surface looks like can you really start to analyse the risk types presented to the business. These risks can be extensive and need prioritisation according to the threat presented to the brand. As the discovery process continues, you need an automated risk assessment tool to save time and effort. It will tell you what the most pressing risks are, so you can focus on the mitigating process. Then, even when the discovery process is ongoing, new risks are automatically reported on, and added to right lists. This ensures you stay up-to-date on the actual risks to the organization – removing a lot of the stress from the process for CISOs.

Risk Prevention

There is a flipside to seeing your whole attack surface. Having a comprehensive overview of every risk your organization faces can be terrifying – you are going to uncover a multitude of things you’d never considered. This can leave you facing one big question: “Do I really want to know all of this?” Most CISOs and cybersecurity professionals are already busy with all the things they do know about, so you need to have a way of striping out and solving some of the possibly lower priority but easier to solve risks in your report. This is again where automation can come into play. Automatically categorizing similar risk types throughout your attack surface will save time and effort when reducing risks.

Integration

Finally, it doesn’t matter how much data you have on something; if it’s not actionable it’s ultimately not going to be practical to use. So you need to be able to connect all that data coming from your attack surface monitoring into your existing internal processes and systems (your PSA, ITSM, or ESM tools etc). That way you can build it into your existing cybersecurity structure and minimise extra work.

More in this series:

No items found.

Like this and want more?

Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Vincent Thiele
Deputy CISO
This Article
What does effective Attack Surface Management look like?
Share
Twitter logoLinkedIn logo

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.