What Is the “Exposure Management” Approach to Cyber Security?

Attack surfaces are entry points that attackers could use to gain unauthorized access to a digital device or sensitive data. Every digital device typically has a network attack surface and host attack surface. Network attack surface refers to active network services that an attacker can interact with remotely via a network connection. This includes wireless protocols such as Wi-Fi and Bluetooth. Host attack surface refers to user accounts, applications, processes, directories, files, and other elements that an attacker could access if they were logged in to a device or in control of a service account. Other attack vectors can also be associated with a device’s attack surface, such as human and physical factors.

The Exposure Management framework for cyber security aims to consider all potential ways that an organization’s digital assets could be breached and apply appropriate security controls based on risk level. Some additional forms of attack surface are:

• Cloud Attack Surface: Cloud resources require special security considerations because they often physically exist outside of an organization’s premises and may involve third-party service providers. Improper access controls, misconfigured cloud assets, and exposed APIs are the most common vulnerabilities that impact cloud attack surface.
• Third-Party Service Providers and Supply Chain Attack Surface: When organizations depend on third parties for digital services or software an implicit trust bond is created. This dependence on security controls outside of the organization is often an inflection point for cyber breaches.
• Shadow IT and IoT Attack Surface: IoT and personal devices connected to a corporate network introduce additional cyber risk. When an organization is unaware that these devices exist it is known as Shadow IT. IoT vendors may not prioritize cyber security in their products, leaving an opportunity for attackers to gain a persistent foothold on an organization’s network. Similarly, personal devices may have rogue apps installed or be missing critical security updates.
• Human Attack Surface: Phishing and other social engineering techniques, inadequately trained employees, or even malicious insiders are all forms of human attack surface. Exploitation can result from even simple actions such as clicking on a malicious file or accidentally misconfiguring a system.
• Identity and Access Management (IAM) Attack Surface: Legitimate user and service accounts are an attractive target for adversaries because they give privileges to the credential holder. Other IAM risks include rogue accounts created by attackers for covert, persistent access, and account sprawl: when unused accounts are not deprovisioned appropriately. The principle of least privilege dictates that each account should be limited to its functional requirements and granular account segmentation can be used to isolate critical functions. Additional security measures such as Multi-Factor Authentication (MFA) and Zero-Trust Architecture (ZTA) provide additional protection to prevent unauthorized access.
• Operational Technology (OT) Attack Surface: Industrial Control Systems (ICS) and other OT environments are increasingly connected to corporate IT networks and the internet. Vulnerabilities in these systems can have significant operational and safety impacts.
• Physical Attack Surface: Physical access to unattended workstations, servers, and other devices can allow an attacker to bypass logical controls. Attackers could potentially steal a device outright or the sensitive data it contains, or tamper with hardware or software to implant malware.