What is Attack Surface Management?

Evaluating an institution's cybersecurity solely by looking at internal systems is no longer sufficient. This is because attackers do not operate by seeing the institution's network diagram, asset inventory, or security policies. They see whatever is on the internet.

A domain. A subdomain. An open port. An outdated server. A misconfigured service. A forgotten resource in the cloud. A leaked user account belonging to employees. And sometimes, a digital asset that even the institution's security team is unaware of. This is precisely the problem that the Attack Surface Management (ASM) approach focuses on solving.

What is Attack Surface Management? Attack Surface Management is an approach of continuously discovering, analyzing, determining risks of, and managing an institution's digital assets that are accessible via the internet. In the classic security approach, the institution first defines its own assets.

In the ASM approach, the question is slightly different: “How does an attacker see us from the outside?” This difference is quite significant. Because the assets known to the institution and the assets actually visible on the internet may not always be the same.

Why is the attack surface constantly changing? It used to be easier to understand an institution's digital infrastructure. There was a data center. There were servers. There was a firewall. There was an institutional network. Today, the picture is much more complex. Cloud services, SaaS applications, remote work, APIs, third-party services, new domains, test environments, and different services used by employees are constantly creating new assets. Moreover, some of these may not exist in the security teams' central inventory at all. Therefore, the attack surface is not a static list. It is a constantly changing ecosystem.

How does an attacker discover a company? From an attacker's perspective, the first stage is often not to attack. First, it is to discover.

What domains exist? What IP addresses are being used? What services are open to the outside? What technologies are being used? Which systems have vulnerabilities? What employee or user information has left a footprint on the internet? When this information comes together, the digital map of the institution begins to form in the attacker's eye. Therefore, security teams must have the same perspective. Being able to see your own institution through the eyes of the attacker.

Are ASM and Vulnerability Management the same thing? No. They are approaches that complement each other but solve different problems. Vulnerability Management focuses more on detecting and remediating security flaws on known assets. ASM, on the other hand, primarily seeks an answer to this question: “What assets do we have, and which of these are accessible from the outside?” To simplify: ASM → Discovers what we are protecting. Vulnerability Management → Helps us understand how risky these assets are. For this reason, both approaches must work together in a strong security program.

Why is ASM not just a scanning tool? It would be incomplete to evaluate ASM only as a tool that performs port scanning at certain intervals. In the modern ASM approach, the goal is;

• Discovering digital assets

• Identifying newly emerging assets

• Seeing services accessible from the outside

• Analyzing technologies and configurations

• Correlating vulnerabilities

• Prioritizing risks

• Continuously tracking changes

and enabling security teams to turn these into action. Because the problem is not just the existence of a vulnerability. The real problem is the emergence of risk on an asset that the security team does not know about.

So, where should institutions start? The first step is quite simple: Look at yourself through the eyes of an attacker. What assets associated with your institution exist on the internet?

• What ports are open?

• What services are accessible?

• Which systems are outdated?

• Which vulnerabilities are visible from the outside?

• What information about your employees or systems could help an attacker?

The answers to these questions begin to reveal the institution's true external attack surface.

Conclusion -> In cybersecurity, we have been asking an important question for years: “How can we protect our systems?” To this, one more question now needs to be added: “How does an attacker see us?” Because an invisible asset can remain outside of security policies. And an asset that remains outside of security policies can turn into an opportunity for an attacker. For this reason, Attack Surface Management is not just a new security technology; it is the ability to continuously see where the institution stands digitally. And the first rule in security still hasn't changed: You cannot protect what you cannot see.

If you are curious about how your institution looks on the internet, let's take a look together from the outside. info@buteksoft.com.tr