Attack Surface Management
Attack surface management is the continuous process of discovering, inventorying, and reducing the external-facing assets and exposures that an attacker could target. It maps what an organization exposes to the internet and prioritizes risks based on exploitability and business impact.
itDefensive security and security operations | OpenSkills.info
Intro
Attack Surface Management
Your attack surface is the set of paths an attacker could use to reach assets, affect operations, or take data. It includes more than known vulnerabilities. An unnecessary service, forgotten domain, exposed administration page, weak cloud policy, or abandoned application can all create an opening.
Attack surface management, or ASM, is the continuous work of finding those openings, deciding which ones matter, and reducing the resulting risk.
Use this mental model:
discover → attribute → enrich → prioritize → remediate → verify
↑ ↓
└──────────────── observe change ───────────────────┘
The loop matters more than any scanner. Infrastructure changes, cloud resources appear, acquisitions add domains, and teams retire systems incompletely. A one-time inventory starts aging as soon as discovery ends.
Scope the surface before you measure it
ASM can cover digital and physical assets. Most security programs begin with the digital attack surface because it can be observed and changed through repeatable technical processes.
The digital surface has several views:
- External attack surface — internet-accessible domains, hosts, addresses, services, applications, certificates, and third-party dependencies.
- Internal attack surface — systems, identities, trust relationships, management planes, and services reachable after an attacker gains an internal position.
- Application attack surface — input and output paths, privileged functions, APIs, files, valuable data, and the controls that protect them.
- Cloud attack surface — public endpoints, control-plane identities, storage exposure, workload identities, and configuration relationships across cloud accounts.
- Human attack surface — identities and workflows that an attacker may target through credential theft or social engineering.
External attack surface management, or EASM, is a subset of ASM. It observes your organization from outside the network. This view can reveal assets that internal inventories or endpoint agents miss.
No single view is complete. External discovery cannot see every internal trust relationship. An endpoint inventory cannot see an abandoned domain with no agent. Application analysis cannot prove who owns every public host.
Define the scope in operational terms. Record which organizations, subsidiaries, brands, networks, cloud accounts, and suppliers belong in the program. Also record exclusions and the authority under which discovery operates.
Build an evidence-backed inventory
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.ncsc.gov.uk/guidance/external-attack-surface-management-buyers-guide
Supports
- ASM as identification, monitoring, and reduction of vulnerabilities across organizational assets
- EASM as the internet-accessible subset of ASM and an outside-in defender view
- Ongoing automated discovery and monitoring of domains, addresses, services, technologies, certificates, suppliers, and web presence
- Security analysis for unsupported software, configuration weaknesses, exposed services, DNS, email, web, and vulnerability conditions
- Workflow, history, trend, integration, configurable priority, and organizational context requirements
- Ownership-confidence validation, exclusions, asset management integration, and product limitations
- https://cheatsheetseries.owasp.org/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.html
Supports
- Attack surface as entry and exit paths, valuable data, and the controls that protect them
- Mapping functions and system areas that need vulnerability review and defense in depth
- Grouping attack points by risk, purpose, implementation, design, and technology
- Prioritizing remote and public entry points and tracking changes to risk profile
- Reassessing security when a change introduces a new type of input, interface, or technology
- Application attack-surface scope and its relationship to threat modeling
- https://www.cisa.gov/news-events/directives/bod-23-01-improving-asset-visibility-and-vulnerability-detection-federal-networks
Supports
- Continuous and comprehensive asset visibility as a precondition for cybersecurity risk management
- Asset discovery and vulnerability enumeration as distinct operational activities
- Active scanning, passive flow monitoring, log queries, and software-defined infrastructure APIs as discovery methods
- Vulnerability enumeration of operating systems, applications, ports, versions, missing updates, and misconfigurations
- Recurring discovery and enumeration as a time-bounded operational practice for the directive's federal scope
- https://csrc.nist.gov/CSRC/media/Projects/risk-management/800-53%20Downloads/800-53r5/SP_800-53_v5_1-derived-OSCAL.pdf
Supports
- CM-8 requirements for accurate, complete, appropriately granular, and reviewed component inventory
- Automated inventory maintenance, unauthorized-component detection, accountable administrators, and centralized repositories
- RA-5 requirements for vulnerability monitoring, analysis, risk-based remediation, information sharing, and updated scanning capability
- Scanning for patch levels, functions, ports, protocols, services, and weak flow controls
- Defined breadth and depth of coverage, review of discoverable information, trend analysis, and privileged scanning
- Correlation of scanning information for multi-vulnerability and multi-hop attack vectors
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Supports
- The catalog as CISA's authoritative source for vulnerabilities exploited in the wild
- Use of KEV as an input to vulnerability management prioritization
- Distinction between known exploitation evidence and local asset exposure or impact
- https://www.first.org/epss/user-guide.html
Supports
- EPSS as a probability estimate for exploitation activity based on vulnerability and real-world exploit data
- EPSS as one threat consideration rather than a complete risk score
- The need to combine exploit probability with accessibility, weakness type, asset purpose, value, and impact
- Different roles for vulnerability severity and data-driven threat information in prioritization
- https://www.first.org/epss/faq
Supports
- EPSS as an estimate of exploitation activity in the next thirty days
- EPSS limits regarding environmental context, compensating controls, and impact
- Exploitation evidence superseding a prediction when current evidence exists
- https://learn.microsoft.com/en-us/azure/external-attack-surface-management/what-is-discovery
Supports
- Seed-based recursive discovery as one vendor implementation pattern
- Domains, address blocks, hosts, email contacts, autonomous system numbers, and registration organizations as seed types
- Inventory distinctions among approved assets, dependencies, monitor-only items, candidates, and items requiring investigation
- Reduced ownership confidence as discovery moves through weaker relationships
- Continuous observation of inventory assets after discovery
- https://www.ncsc.gov.uk/guidance/asset-management
Supports
- Asset management as maintained knowledge of assets relevant to cyber security
- Shadow IT as assets outside organizational asset and risk processes
- Ownership, lifecycle, vulnerability, and authoritative record context for ASM enrichment