Full Report
How Group-IB Attack Surface Management ensures full mastery of your external attack surface
Analysis Summary
# Best Practices: External Attack Surface Management (EASM)
## Overview
External Attack Surface Management (EASM) addresses the continuous discovery, inventory, classification, and monitoring of an organization's internet-facing assets. These practices aim to eliminate "shadow IT," identify misconfigurations, and close security gaps like exposed login forms or outdated software before threat actors can exploit them.
## Key Recommendations
### Immediate Actions
1. **Asset Discovery & Inventory:** Conduct an automated scan of all internet-facing assets (IPs, domains, subdomains, and cloud instances) to identify unknown or "shadow IT" resources.
2. **Audit Remote Access Points:** Identify all exposed RDP, SSH, and VPN gateways. Ensure no legacy or "temporary" login forms are left accessible to the public internet.
3. **Emergency Patching:** Immediately update high-risk components such as outdated jQuery libraries or web servers with known CVEs.
4. **Credential Audit:** Disable default credentials (e.g., "admin/admin") on all discovered login portals.
### Short-term Improvements (1-3 months)
1. **Multi-Factor Authentication (MFA) Enforcement:** Implement MFA across all discovered remote access services and administrative panels.
2. **Vulnerability Prioritization:** Transition from basic scanning to risk-based vulnerability management, focusing on assets that are most exposed or contain sensitive data.
3. **Domain & SSL Management:** Catalog all SSL certificates and domain registrations to prevent expiration-based outages or subdomain hijacking.
### Long-term Strategy (3+ months)
1. **Continuous Monitoring Integration:** Move away from point-in-time assessments to 24/7 automated monitoring of the attack surface.
2. **Attack Surface Reduction:** Decommission unused domains, marketing microsites, and legacy staging environments that no longer serve a business purpose.
3. **Threat Intelligence Integration:** Feed attack surface data into a Threat Intelligence platform to understand which of your specific assets are being targeted by known threat actor groups.
## Implementation Guidance
### For Small Organizations
- Focus on low-hanging fruit: Ensure all web-facing logins have strong passwords and MFA.
- Use free tools for basic network protection assessments and malware reporting.
- Prioritize securing the main company website and email gateways.
### For Medium Organizations
- Implement automated EASM tools to track assets across growing cloud and on-premise environments.
- Establish a policy for "temporary" marketing domains that includes a mandatory decommissioning date.
- Conduct regular Penetration Testing or Vulnerability Assessments.
### For Large Enterprises
- Utilize a Unified Risk Platform to consolidate EASM, Threat Intelligence, and Digital Risk Protection.
- Deploy an Incident Response Retainer to ensure rapid action if a discovered vulnerability is exploited.
- Focus on supply chain security by monitoring the attack surfaces of third-party partners and subsidiaries.
## Configuration Examples
While specific code varies by platform, the following configuration logic should be applied:
* **SSH/RDP:** Restrict access via IP Whitelisting or a Zero Trust Network Access (ZTNA) gateway rather than exposing ports directly to the internet.
* **Web Servers:** Disable directory listing and remove "Server" headers that reveal specific software versions (e.g., `Server: Apache/2.4.6`).
* **Login Forms:** Implement rate-limiting and account lockout policies to prevent brute-force attacks.
## Compliance Alignment
- **NIST CSF:** Supports "Identify" and "Protect" functions through asset inventory and vulnerability management.
- **ISO/IEC 27001:** Aligns with A.12.6 (Technical Vulnerability Management).
- **CIS Controls:** Directly addresses Control 1 (Inventory and Control of Enterprise Assets) and Control 7 (Vulnerability Management).
## Common Pitfalls to Avoid
- **"Set and Forget" Mentality:** The attack surface changes daily; monthly scans are insufficient for modern threats.
- **Ignoring Shadow IT:** Relying solely on internal IT documentation rather than external "outside-in" discovery.
- **Marketing Silos:** Allowing marketing or non-technical teams to spin up domains and servers without IT oversight or security hardening.
- **Low-Risk Negligence:** Assuming a non-critical server doesn't need security; threat actors use minor assets to gain a foothold and move laterally.
## Resources
- **Group-IB Attack Surface Management:** hxxps[://]www[.]group-ib[.]com/products/attack-surface-management/
- **Network Protection Assessment Tool:** hxxps[://]trebuchet[.]gibthf[.]com/?tab=network
- **CIS Critical Security Controls:** hxxps[://]www[.]cisecurity[.]org/controls/
- **NIST Vulnerability Management:** hxxps[://]csrc[.]nist[.]gov/