Blog

PREVENT

Understanding your organization's attack surface and why it poses a risk

Understanding your organization's attack surface and why it poses a riskDefault blog imageDefault blog image
03
Jun 2021
03
Jun 2021

Your attack surface is the sum of the exposed and internet-facing assets, and the associated risks a hacker can exploit to carry out a cyber-attack. Over the past decade or so, that attack surface has changed dramatically. Long gone are the days when the only things exposed to the outside world were your website and your mail server.


Today, increased complexity means that many organisations often have huge attack surfaces – in fact, we believe that the attack surface has grown by around 1000% in the past 10 years.

A constantly changing problem

If that wasn’t enough of a challenge in itself, the modern attack surface is constantly evolving. The explosion of connected technologies means there are a host of new threat points within organisations: from third-party SaaS and IaaS providers, to VPNs, and from marketing partners who run campaigns and build infrastructures for you to the challenges of BYOD and shadow IT.

On top of this, the agile development world of DevOps is an additional challenge with apps being central to most financial institutions’ business models. The use of bi-weekly sprints and continuous deployments means infrastructures are in an almost constant state of change.

Below is just a quick snapshot of some of the areas where different departments can make changes to your attack surface under the radar and that you need to be aware of when trying to protect your data:

  •    Cloud adoption, migrations – Exposed assets and storage buckets
  •    Development Team – New Assets and Testing
  •    Networks – New Netblocks and advertisements
  •    Marketing – New subdomains for landing pages hosted at design companies
  •    Sales – Campaigns and e-Commerce
  •    IT operations – Configuration Changes, Patching, New Assets, and services
  •    Security – Fixes, Agent deployments, new assets
  •    Mergers and Acquisitions – Risk associated with newly acquired assets
  •    Subsidiaries – Complexities of assets not controlled
  •    Supply Chain Risk – Hosting providers, third parties

And that’s without taking into account the effects of the Covid pandemic. Changing infrastructure due to new working practices alongside the turbo-boost that digital transformation has been given resulting in a rapid shift to the cloud of everything from HR services to core business applications, have added a whole new layer of possible weak points and attack vectors for organisations. Every one of these factors increases the risk of your business’s data being compromised in some way.

Attackers are changing too

But it’s not just the proper indexing and management of new assets that you need to be concerned about. Attackers are getting more and more sophisticated in the techniques and technologies they use to locate and exploit vulnerabilities, and different areas of exploitation are appearing all the time.

Many companies already deploy a range of both defensive and offensive techniques to defend their networks from cyber attacks, including advanced, complex and expensive Threat Intelligence teams that track campaigns run by cyber criminals.

However, even if you do have the money and resources to create skilled teams like this, something as simple as a web server with an exploitable vulnerability can easily go unnoticed, leaving it open for a threat actor to exploit that asset. And in the end, manually checking and fixing every little misconfiguration is not the kind of repetitive work you employ an expert team for.

Don't be undone by simple mistakes

Malicious or just simple mistakes are almost impossible to track and control, and they can result in the most extensive exposures to a business. There are constant examples of configuration changes implemented that resulted in regulatory breaches or opening vulnerabilities that have been exploited. Security teams will focus on external and internal actors, but monitoring resulting changes requires an external view.

With your attack surface moving and changing all the time, it is crucial to be in control of this on a day-to-day basis, and to understand the risks posed to your organisation. Yet, having the comprehensive overview that allows you to be in control and to protect against threat actors has seemingly never been more difficult to achieve.

If your organisation continues to take an inside-out approach to your security, you will not be able to see the blind spots that will ultimately introduce the brand's biggest risk. Instead, you can see how a threat actor sees your business and your brand by deploying an effective attack surface solution that gives you a comprehensive view of where your possible threats are.

Ultimately, this allows you to take back control of your attack surface by monitoring risk, confirming changes have been made, and monitoring security policy governance. Such an automated solution will not only help detect the biggest security threats, but will also provide the insights into your overall attack surface, giving you all the data needed to take your security to the next level.

Like this and want more?

Receive the latest blog in your inbox
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
INSIDE THE SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AUTHOR
ABOUT ThE AUTHOR
Vincent Thiele
Deputy CISO
This Article
Understanding your organization's attack surface and why it poses a risk
Share
Twitter logoLinkedIn logo

Good news for your business.
Bad news for the bad guys.

Start your free trial

Start your free trial

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get a demo

Flexible delivery
You can either install it virtually or with hardware.
Fast install
Just 1 hour to set up – and even less for an email security trial.
Choose your journey
Try out Self-Learning AI wherever you most need it — including cloud, network or email.
No commitment
Full access to the Darktrace Threat Visualizer and three bespoke Threat Reports, with no obligation to purchase.
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.