Techniques Used in Attack Surface Discovery and the Challenges of Mapping an Organization

At a time when the cloud estate of organizations is expanding faster than ever, the attack surface is becoming harder to monitor. 

This blog post aims to demystify attack surface discovery. We’ll explore what it involves, why it’s important, and how it fits into securing your digital assets. 

By the end, you’ll understand why a nuanced approach to attack surface discovery isn’t just beneficial; it’s essential for staying a step ahead against today’s sophisticated threats. 

What is Attack Surface Discovery 

The three attack surface layers 

With the relentless evolution of technology come equally relentless threats, rendering continuous attack surface management no longer optional. Given that, organizations deal with attack surfaces, which can be separated into three distinct layers: 

• IT-operated assets: These are the assets that your organization’s IT teams operate. They are deployed in your on-premises data centers and across your organization’s cloud accounts and form the core of your digital attack surface.  

• Vendor-managed assets: This layer includes assets running on external vendors and partners’ IT infrastructure, such as SaaS platforms, hosting services, and managed services. While vendor-managed assets play a major role in business acceleration and modern operations, they introduce additional complexities to your attack surface.  

• External assets: These connections and dependencies form your organization’s digital supply chains. They extend your attack surface beyond your immediate control and include everything from third-party services to public infrastructure like email or DNS. Hackers can steal sensitive information, disrupt operations, and cause significant financial losses as they seek the path of least resistance in exploiting an enterprise. This can often be found in a mismanaged asset, weak link or ungoverned digital supply chain asset.  

Discovery elements 

Here are some of the key attack surface discovery methods needed to identify and map all the internet-exposed assets an organization has and their digital supply chains. This includes web applications, cloud services, mail servers, and network devices. These assets’ exposures form the organization’s attack surface, which is the total sum of all security risks that a malicious attacker can use to gain unauthorized access to an organization’s systems or data.: 

1. Mapping the organization 

Before embarking on the complex task of mapping digital assets, it’s essential to comprehensively map out the organization. This entails identifying and cataloguing various elements such as the organization’s names, brands, keywords, and entities. 

This comprehensive approach to mapping not only aids in maintaining compliance with various data privacy regulations but also provides a clearer understanding of the data and assets under the organization’s control, which is vital for external attack surface management. 

Modern enterprises are complex – with many subsidiaries, business units, brands, etc.  

Before you can discover what assets, the organization has, you need to understand the organization’s structure.  

This information is typically not available in any single place. 

Our primary goal is to compile an extensive and secure repository of meaningful names and websites related to the company. This repository will serve as a foundational element in our attack surface discovery, aiding in digital asset management, threat intelligence and ensuring the integrity of our digital footprint.  

2. Tracking organization’s certificates 

Certificates are used by organizations to secure their web services and applications. By tracking certificates issued to an organization, you can identify web domains, servers, and services that belong to that organization. Reviewing how a company presents itself in its SSL certificates can yield telling features.  

3. Tracking global domain registrations 

Prior to initiating a scan of a company, we need to identify key data points that will be useful in the discovery process. These include name variations commonly used in asset registrations, frequently utilized DNS servers, top-level domains (TLDs) owned by the company 

4. Subdomain discovery 

Subdomain discovery is a key technique in continuous attack surface mapping, revealing the in-and-outs of a website’s structure for a subsequent assessment. Tools like Sublist3r, Amass, and Nmap automate this process, employing methods from brute-force to DNS enumeration​​.  

These tools unearth hidden subdomains, providing a more comprehensive view of digital assets. Efficiently mapping and securing subdomains is crucial for continuous attack surface management and ensuring a fortified digital presence against evolving threats. 

5. IP discovery 

IP addresses are like digital fingerprints that uniquely identify devices online. Figuring out which ones construct the company’s digital footprint is where the real game starts. 
The IP discovery process is designed to automatically find all the IPs and CIDRs of a certain company.  
 

The internet is a giant jigsaw puzzle. You’re piecing together a picture of your organization’s digital footprint by Using distributed scanning engines and machine learning asset models, you get a reverse map of IP spaces, domains, and subdomains, each iteration sharpening the accuracy of your asset inventory. It’s not just about finding what’s yours; it’s about understanding how it connects and evolves, ensuring you’re always a step ahead, and maintaining an updated attack surface. 

6. Public cloud mapping  

The rapid expansion of cloud infrastructure, identities, and storage nodes substantially widen the attack surface. Effective cloud attack surface management involves continuous asset discovery and monitoring, risk validation, and understanding of subsidiary risks often associated with cloud deployments. 

7. Mapping connections  

Mapping connections is like drawing your network’s blueprint. This process involves identifying and continuously monitoring every link in the chain — This process is vital for identifying blind spots and potential vulnerabilities by understanding how different assets, such as web, DNS, SaaS, and IP, interconnect and interact​​. 

8. Mapping the digital supply chains  

Mapping digital supply chains provides visibility into an organization’s interconnected external dependencies, including suppliers, cloud services, public infrastructure like DNS, and technology platforms​. Organizations can dynamically track their supply chain threats, assess their exposure, and continuously collect and analyze data from various sources, engaging in continuous threat exposure management.

9. Identifying vendor-managed environments 

Identifying vendor-managed environments within the attack surface is complex. It requires continuous discovery, inventory, classification, and monitoring to ensure all assets, especially those not directly controlled by the organization, are accounted for​​.  

The challenge lies in achieving complete visibility and continuous monitoring to manage risks before attackers exploit them​​. Attack surface management tools, including SaaS, cloud-based, and managed systems, play a key role in automatically discovering and assessing these external assets. 

Attack surface discovery challenges  

Here are some of the major hurdles the organizations need to address when it comes to being effective with their attack surface discovery: 

• Unknown assets: The rapid increase in connected devices and online services complicates identifying all assets and potential vulnerabilities, and manual inventory processes are ineffective​​, thus unearthing blind-spots is imperative. 

• Scale and complexities of modern enterprises: Modern businesses and their subsidiaries face growing challenges as their attack surfaces expand with the increasing use of various devices, platforms, and cloud services. This continuous growth complicates the management and monitoring processes and opens up new opportunities for cybercriminals to find and exploit vulnerabilities. 

• Dynamic environments: The shift to the cloud has expanded the attack surface, introducing sensitive data traversing unsecured networks and limited visibility into distributed assets. These changes create a dynamic environment that’s challenging to monitor and secure​​. 

• Identifying assets beyond direct control: Conducting a comprehensive attack surface assessment is crucial but is only as effective as the asset inventory available. Identifying and assessing the impact of assets beyond direct control, such as those in cloud environments or with third-party vendors, is a significant challenge​​. 

Continuous discovery process using machine learning models 

Understanding and managing your attack surface is not a one-time task but an ongoing journey of discovery and adaptation. Enter, IONIX’s machine learning-driven approach: a continuous, iterative process that evolves with every scan, honing in on the organization’s expanding digital footprint. By combining deep domain mapping, global tracking, and intelligent data enrichment, IONIX doesn’t just find assets; it understands them, ensuring a robust and resilient defense against the evolving threats of the digital age. Click here to see it in action.