Attack surfaces are constantly expanding. Thanks to prevalent use of the cloud, more interconnected applications, and more smart devices, the digital footprints of most organizations are growing. With those apps and devices, however, come more vulnerabilities for attackers to exploit. According to a recent report, 2 out of 3 organizations say their external attack surface became larger in the last year.
The same report found that companies are having a difficult time keeping up with the rapid growth of their attack surface. Almost three quarters of organizations are using spreadsheets to track their attack surface, but it’s slow going: it takes more than two weeks for the average company to update their records after their attack surface expands.
This article will explain what an attack surface is, explore the common risks associated with attack surfaces, and offer suggestions for analyzing and managing your attack surface.
What is an Organization’s Attack Surface?
An attack surface refers to all the points in a system or application that can be targeted, exploited, or compromised in order to carry out a cyberattack. These points might include vulnerabilities in the software, misconfigurations in the network or system, or human errors such as weak passwords or poor security hygiene.
The larger the attack surface, the greater the potential for an attacker to find a vulnerability in the system. For this reason, it’s important for organizations to minimize their attack surface by implementing strong security measures such as firewalls, intrusion detection systems, and regular security audits to identify potential vulnerabilities.
Different Types of Attack Surfaces
Although “attack surface” is a cybersecurity term, the attack surface itself isn’t always digital. There are a few different types of attack surface:
Physical attack surface
A physical attack surface comprises all the real-world vulnerabilities that allow an attacker access to your data, devices, and networks, including:
- Poor physical security: Physical security problems that allow outsiders to gain access to a site and its devices, such as poor access control, unattended or unlocked devices, and passwords written down and left on desks where they can be seen.
- Insider threats: Malicious insiders might work against you from inside your organization, sterling data, disabling security controls, or allowing other bad actors into your system.
- Theft: Bad actors may steal devices to access data and networks and other privileges.
- Baiting: Cybercriminals sometimes leave malware-infected USB drives in public places, hoping curious individuals will plug them into their devices to see what’s on the drives. Once plugged in, the malware is downloaded.
Digital attack surface
A digital attack surface includes all digital vulnerabilities that can compromise your data and networks:
- Known assets: Registered domains and subdomains, SSL certificates, servers, devices, applications, and any endpoints used by your employees.
- Unknown assets: Shadow IT, old and forgotten apps or infrastructure, or orphaned user accounts that weren’t shut down when the user left the organization.
- Third-party assets: Any assets that have access to your networks and data, such as vendors, third parties, or partners.
- Malicious assets: Fake domains and subdomains that criminals sometimes create to impersonate your brand and trick unsuspecting customers.
What are the Risks Associated with Attack Surfaces?
One of the biggest attack surface risks is that a bad actor might find and exploit a vulnerability before your organization knows it exists. This is the reason Shadow IT is so dangerous.
What is Shadow IT?
Shadow IT refers to any technology being used by departments or individuals within a company without approval from the central information technology department. In many cases, Shadow IT is being used as a work-around; the members of a department don’t like working with the established technology, so they decide to use another solution.
The trouble is that IT can’t protect technology it doesn’t know about; Shadow IT presents a major risk to organizations when it comes to attack surfaces. Recent research found 7 in 10 organizations were compromised by shadow IT.
Human error
Humans are often the weakest link in any attack surface. Phishing only works if a human is tricked into clicking on a link, and infected USB drives don’t plug themselves into devices. We make lots of mistakes, and that can compromise data, networks, and systems. Some such errors include weak passwords, misconfigured IT infrastructure, and the potential to be tricked by a social engineering attack.
Common Risks to Attack Surfaces
There are several common attack surface vulnerabilities that organizations should be aware of when it comes to securing systems and applications. Below are seven of the most common:
- Unpatched software: Criminals count on you not to update your applications and systems. They know when patches are released, they know what vulnerabilities are being patched, and they’re eager to exploit them.
- Weak passwords: Passwords that are easy to guess or crack can provide an easy entry point for attackers, so tightening your password protocols is a good way to secure your systems.
- Misconfigured systems: Systems that are not properly configured can create security holes attackers can exploit.
- Social engineering attacks: Phishing and other social engineering attacks are designed to trick individuals into divulging sensitive information or clicking on malicious links. While many phishing campaigns are easy to spot, some attacks are sophisticated and difficult to identify.
- Malware: Malware such as viruses, Trojans, and ransomware can infect systems and steal or encrypt data.
- Insider threats: Malicious insiders who have access to systems and data can intentionally or unintentionally create vulnerabilities that can be exploited by attackers. Sometimes these insiders are disgruntled. Sometimes, they’re being bribed by an outsider.
- Third-party risks: You can control your own security controls, but third party vendors are a risk. They can create vulnerabilities if their own security practices are not up to par, especially if they have unrestricted access to your systems, devices, and data.
How Flare Can Help with Attack Surface Management
It’s not always easy to get a full view of your organization’s external risks. Flare provides a real-time view of your attack surface and helps you proactively remediate digital risks. Our platform sends you context-rich alerts about misconfigurations, data leaks, and other high-risk exposures. You also get in-depth monitoring of the dark web, Telegram channels and other external sources for leaked credentials from previous breaches. You can then prevent data breaches by addressing those weak spots in your infrastructure.
