Within any organization.
We have networks which include firewalls, servers, routers, switches, clients, you name it.
If it's in the network, it's there.
We also have buildings.
These can include doors, windows, parking lots.
We even include fences and block cages.
It can include all kinds of different aspects on the physical world.
An attack surface management takes into place all of those different structures within the network,
i.e. the logical world as well as the physical world, i.e. the buildings and the manpower.
We take a comprehensive approach to identify and eliminate as many of these attack vectors as humanly
possible.
Sometimes we can't always eliminate them, but can we mitigate the opportunity that attackers can utilize
that vector in order to attack our organization?
Often when we look at edge discovery, we look at the overall perspective of the router on the internet,
what is the edge of our network?
And in most cases, it's going to be that one single router with redundancy at the edge of our computer
network.
This logical device that provides network address translation is the demarc between us and the rest
of the world, and we need to identify it to adequately protect it.
Edge discovery is the process of understanding how much of the information the attacker can gather from
that edge point of view, whether it's the router or the server proxy.
We need to understand what can the attacker see within our network from the edge on end into our organization,
and how do we eliminate their perspective of seeing all that information inside of our network?
We can often use security control testing to identify and eliminate certain controls within our within
our enterprise environment, we often look at security scanning and we scan our assets, which we've
talked about before We do an a risk assessment.
Vulnerability scanning.
We can also do what's called penetration testing, security auditing, ethical hacking, or even a posture
assessment to find out how is our organization doing in comparison to where we would like to be.
All of these scans and tests that we perform all have the same function in mind.
How do I eliminate as many of the attack vectors as many of the vulnerabilities accessible from an outside
threat as humanly possible?
And now I said outside threat.
But we also have to be looking at our internal employees as well.
It's not uncommon to have an internal employee plug in a USB drive or get mad at our company and decide
they're going to attack us from a different perspective inside of our own network.
How do we identify that and how do we deal with it?
Pentesting, or penetration testing, is utilization of hacking to identify different vulnerabilities
inside of our network and take advantage or exploit those vulnerabilities.
A pentesting is a contractual agreement between the organization and a team of pentesters, whether
inside your own company and hired or outside your company i.e. a third party to evaluate your network,
evaluate the vulnerabilities, and then go through and actually exploit them.
Their job is to take an outside look of your organization and figure out where your weakest inside your
stance.
They often require a scope of work, which clearly identifies what they're allowed to do and what they're
not allowed to do.
Certain things that they may not be allowed to do is maybe social engineering your employees.
Maybe you as an organization, don't want your employees dealing with that, and it could provide some
legal parameters or legal problems for you.
There was a pen test created in Texas years and years ago where a pen testing company went through,
and they were hired by a city to perform a pen test on their organization's computer system.
They took it a step too far and broke into the physical records room to show that they were vulnerable
to physical penetration testing.
The cops caught up to them.
They laughed it off.
They showed their contract, However, their scope of work did not detail physical access to their records
room.
This problem, within their contractual obligation, meant that they were actually charged and fined
for breaking and entering into an area they were not allowed to be in.
Penetration testing is very identified.
It is a very thin scope of work and is clearly defined with what they can and cannot do.
If you're interested in pen testing, one of the first things I tell everyone go get a lawyer.
Make sure they're reviewing your contract and make sure you're being legal about it.
It's very easy to cross that line and end up in jail if you're not careful.
Bug bounty programs offer an efficient method for rapidly identifying vulnerabilities through a crowdsourced
approach.
There's many companies that have bug bounty programs.
Within a bug bounty program, you're often go to their website.
You sign up to identify yourself.
You fill out some paperwork and some emails.
You correspond with them, and then you're certified as a bug bounty tester.
Once you've identified, you then to go through and test their website.
Now, a bug bounty is sort of a penetration tester perspective, but it's much more crowdsourced.
It's much more open source.
You can test their web applications.
You can test their internal systems if you have permission.
Again, make sure you're identifying what your scope of work includes with a bug bounty program.
Once you've identified a flaw, you're contractually obligated to turn that flaw over to them, and
in return, they pay you for identifying the flaw.
This often occurs where the higher severity of the flaw is, or the more technical the flaw is, the
more money they pay you.
It's not uncommon to have bug bounty programs and companies like Tesla or even Microsoft.
Now, I would look on those websites and make sure they're still active before I go out there and start
randomly testing or performing web penetration testing on their mobile sites, you could get yourself
in a lot of trouble with different legal problems.
Reduction of the attack surface to a system or organization is paramount for any Organization.
We want to do surface reduction for the attacker's perspective.
We want to do control testing.
We're testing how it works.
We're testing hey, what does the attacker have access to?
What can they see as much of that attack surface that we can eliminate or eliminate is good for us as
a whole.
We want to do vulnerability assessments.
How is the vulnerability interacting?
What can the attacker see as far as vulnerabilities go?
Can I eliminate all or as many of those vulnerabilities as possible?
A vulnerability assessment can teach us those perspectives.
We talked about penetration testing.
We talked about bug bounty programs.
We really want to understand what is our attack surface, and how can I eliminate that attack surface
so that people can't see what my internal workings of my programs or my infrastructure is?
But this goes beyond just our enterprise environment.
What about our gates?
What about our doors?
If I have a physical access into a system, then I've eliminated all the technical approaches that you
can handle.
I had a company that I worked for where their server room was at the bottom floor of this installation,
and at the time we had employees that smoked to get into our building, you had to go through a gate
and that gate had a problem.
It was often broken.
People were always working on it.
It wasn't uncommon in 2 or 3 days out of the week to have that gate wide open with nobody guarding it,
no pen code required, but it would usually be fixed by the middle of next week, only to have it break
again another week and being standing wide open.
This was a problem.
It opened up our attack surface.
Once you went in, you went into the parking lot and you had to go through a gate.
You had to keycard yourself into the main entry point.
There was a security guard standing there waiting to take anybody that didn't have the proper code or
the proper identification.
We would have vendors showing up all the time, and it wasn't uncommon to have a vendor come in, identify
themselves, and then meet with somebody to have them take to the appropriate building or the appropriate
office to meet with the person they were going with.
However, you could easily tailgate in those areas.
I remember one time I was literally carrying 2 or 3 boxes and somebody just let me right in.
I had no idea who they were, and the security guard didn't even check my verification of my ID to make
sure that I worked there.
Now, I had seen that security guard 2 or 3 times, so maybe he saw me.
Maybe he didn't.
But the fact is that the man that he didn't check my security credentials, I could have been fired
yesterday or even 2 or 3 weeks ago, and he probably wouldn't have been the wiser.
The problem is, is that I didn't have to go through any of that if I wanted to break into the company
server room, because on the back door, smokers would often prop that door open so they could easily
access the building, smoke their cigarette, and then they would just leave it open willy nilly, especially
during a nice spring day.
So without having those controls in place, I've opened my entire server room to physical access.
Physical access means that I can bypass firewalls, I can bypass IDs, I can bypass millions, if not
billions of technical controls just by plugging a USB into the server.
This is a problem.
We need to identify all attack surfaces and make sure our policies are being followed to the T.