Attack surface management is a key phase in data security, as it identifies, oversees, and controls the areas that will likely be exploited by threat actors or used as entry points for malicious attacks. It sounds like a simple task given the many modern cybersecurity tools available now. However, the situation is more complex than what is perceivable.
A 2022 ESG research report on security hygiene and posture management reveals that around four in ten organizations consider growing and changing attack surfaces as the cause of the increasing difficulty of security operations. This may not be the sentiment of an overwhelming majority, but it shows how something oft-neglected or regarded as an ordinary routine has a significant impact on an organization’s security, particularly when it comes to data protection.
There are serious challenges in attack surface management, and it is worth exploring them to resolve weaknesses at one of the earliest points of security posture management.
Growing reliance on external assets or resources
In the age of cloud computing, it has become commonplace for organizations to employ various web services as part of their everyday operations. They store data in the cloud, run web apps, rely on third-party-managed software supply chains, and even make use of third-party security services. These external resources and services more often than not gain access to an organization’s data, including sensitive information that may be exposed to various risks.
It is for this reason that security firms developed specialized attack surface management solutions. Security visibility is already challenging when dealing with internal resources. The difficulties worsen when there are external attack surfaces involved. With external parties allowed to gain access to enterprise data, it is crucial to have a system that expands automatic attack surface discovery into external resources.
There is a need to identify high-risk exploitable vulnerabilities. Any attempt to take advantage of these vulnerabilities should be quashed from the get-go. It also helps to have a system that quantifies attack surface risks to guide security decision-making, especially when prioritization is needed.
The identification of vulnerabilities or security weaknesses in external resources can be undertaken through breach and attack simulation, continuous automated red teaming, and advanced purple teaming. It also helps to consult established cybersecurity frameworks like MITRE ATT&CK, which is updated with the latest threat intelligence including complex attacks that may be designed to spot security weaknesses in external resources.
Staggering sophistication and rapid evolution of attacks
Just when cybersecurity teams think they have already identified all attack surfaces and plugged all possible vulnerabilities, relentless threat actors manage to exploit an unexpected weakness in an unlikely attack surface. This is not a rare situation in cybersecurity. Underestimating hackers and cybercriminals should be the last thing on the minds of cybersecurity teams.
Artificial intelligence appears to be a friend to cybersecurity teams and a foe for cybercriminals. According to a 2022 report by Acumen Research and Consulting, the global AI cybersecurity market is expected to reach a valuation of $133.8 billion by 2030, a significant jump from its 2021 level of only $14.9 billion. However, this rosy picture has a foreboding backside: cybercriminals can also use artificial intelligence to boost their attacks.
A recent report says “bad guys may benefit the most” from artificial intelligence. It is generally easier to formulate attacks than to establish defenses. As such, cybercriminals tend to have the edge when they fight AI cybersecurity with their AI attacks.
AI can be used to scour personal information on the web and open source data that can be useful in generating effective phishing emails. Alarmingly, these AI-generated phishing emails are reportedly more likely to be opened (by their target victims) as compared to manual or conventional phishing emails.
Moreover, experts say that artificial intelligence can also be used to develop malicious software that is constantly changing to evade automated threat detection systems. Most conventional cyber defenses are static and perimeter-based. They are stuck on a specific location and routine, so they have limited capabilities when it comes to threat detection and mitigation.
There are also AI-driven malware designed to lurk inside a system it has managed to infect and discreetly collect data. The data is then sent to the perpetrators, or the malware may accumulate the data until it is already capable of proceeding to the next phase of its attack.
To address this unfavorable situation, it is advisable to adopt a zero-trust policy across the entire enterprise. Every access to data and resources should be presumed adversarial, to undertake thorough assessments before any permission is granted. Access should never be based on positions or the identity and authority of the user requesting permission.
Of course, it is also important to make more and better use of artificial intelligence as part of the cybersecurity system. Many security providers already employ artificial intelligence to improve the detection and mitigation capabilities of their cyber defenses.
Poor integration of security tools
Attack surface management is usually a component of a broader cybersecurity platform. It is rarely a standalone solution. For it to work, it needs to integrate with other security controls and solutions. Attack surface management typically leverages existing asset management systems, vulnerability scanners, log managers, cloud security posture management, and other tools.
However, they are hit with the reality that obtaining data from the disparate or disjointed systems used by an organization is far from easy. Some 43 percent of organizations, according to the ESG report mentioned earlier, say that it takes 80 hours or more than twice the regular total working hours in a week for them to complete a full attack surface management inventory.
If the consolidation of security data is almost entirely managed by a human team, it is also unavoidable to have costly overhead and human errors. These errors do not only slightly affect attack surface management outcomes. They can cause serious misrepresentations that result in disastrous consequences.
In summary
Attack surface management rarely comes to mind when talking about data security, which is often associated with security control and mitigating measures. However, it is too important especially nowadays when threat actors are more persistent and resourceful than ever. The challenges discussed above are just a preview of the difficulties organizations must overcome to ensure data security and the overall effectiveness of an organization’s security posture.
