According to Microsoft, “The attack surface of a system is the sum of all the ports, protocols, services, and other attack vectors that are exposed to the network.” In other words, it’s everything that an attacker could potentially use to gain access to your systems and data.
Microsoft’s External Attack Surface Management (EASM) is a set of tools and best practices designed to help you reduce your organization’s attack surface. By improving visibility into your external exposure and addressing risks proactively, EASM can help you protect your data and systems from attacks.
In this guide, we’ll provide an overview of Microsoft EASM and how it can help you improve your organization’s security posture. We’ll also share some tips on how to get started with EASM and how to ensure that it’s integrated into your overall security strategy.
External attack surface management overview
nAn external attack surface is the portion of a company’s IT infrastructure that is exposed to the internet and potential threats. It includes all public-facing systems and services, such as websites, email servers, and remote access services. Managing the external attack surface is a critical part of an organization’s security program.
There are a number of ways to manage the external attack surface, including asset inventory and classification, vulnerability management, and security controls assessment. Organizations should also consider implementing a threat intelligence program to help identify and mitigate risks.
Identifying and assessing your external attack surface
. Identifying your external attack surface is the first step in understanding and improving your organization’s security posture. There are a variety of ways to identify your external attack surface, including performing a threat analysis or using a tool like the Open Web Application Security Project (OWASP) Application Security Verification Standard (ASVS).
2. Once you have identified your external attack surface, you need to assess the risks posed by each potential threat. This assessment should take into account the likelihood of an attack and the potential impact if one were to occur.
3. After you have identified and assessed your external attack surface, you can begin to take steps to improve your security posture. This may involve implementing security controls like firewalls or intrusion detection systems, or it may involve training employees on security best practices.
Managing Internet-facing applications and services
ssuming you would like tips for managing internet-facing applications and services:
1. Keep Your Software Up-To-Date
One of the most important things you can do to keep your internet-facing applications and services secure is to make sure you are running the latest versions of all software. New software releases often include security patches for vulnerabilities that have been found and exploited in the wild. By keeping your software up-to-date, you can help close any potential security holes in your applications and services.
2. Use Firewalls
Firewalls can help protect your applications and services from attacks by filtering incoming traffic and only allowing traffic that meets certain criteria through to your systems. You can configure firewalls to block traffic from specific IP addresses or networks, or based on specific ports or protocols.
3. Implement Access Control Measures
Another way to help secure your internet-facing applications and services is to implement access control measures. This can involve using authentication methods like passwords, two-factor authentication, or biometrics to control who has access to your systems. You can also use authorization methods like role-based access control to further restrict what users can do within your applications and services.
4. Encrypt Sensitive Data
Any sensitive data that is stored or transmitted by your internet-facing applications and services should be encrypted to help protect it from being intercepted and misused by unauthorized individuals. Data encryption can be performed at rest (when data is stored) or in transit (when data is being transmitted).
Securing domain name system (DNS) infrastructure
he Domain Name System (DNS) is a critical part of the internet infrastructure, providing a directory of domain names that are translated into IP addresses. DNS is used by every computer that connects to the internet, making it a prime target for attackers.
There are many ways to secure DNS infrastructure, but some of the most important include using DNSSEC to authenticate DNS data, using secure protocols such as TLS, and keeping DNS servers up-to-date with the latest security patches.
DNSSEC is a critical security measure for DNS infrastructure. It uses digital signatures to authenticate DNS data, preventing attackers from spoofing DNS data and redirecting users to malicious websites.
TLS is another important security measure for DNS servers. TLS encrypts DNS traffic, making it more difficult for attackers to snoop on or tamper with DNS data.
Keeping DNS servers updated with the latest security patches is also important. Many vulnerabilities in DNS software are discovered and patched on a regular basis, so it’s important to keep servers up-to-date in order to protect against these threats.
Protecting against distributed denial-of-service (DDoS) attacks
n
A distributed denial-of-service (DDoS) attack is an attack where multiple computers are used to flood a single target with traffic. DDoS attacks are often used to take down websites or online services.
There are a few things you can do to protect against DDoS attacks:
1. Use a DDoS protection service: This is a service that will filter traffic to your website or online service, only allowing legitimate traffic through.
2. Use a content delivery network (CDN): A CDN will distribute your content across multiple servers, so if one server is hit with a DDoS attack, your content will still be accessible from other servers.
3. Limit the amount of bandwidth your website or online service uses: This will make it harder for attackers to flood your target with traffic.
4. Keep your software up to date: Make sure you have the latest security patches installed to help protect against known vulnerabilities that could be exploited in a DDoS attack.
Managing access to external resources
here are a number of ways to manage access to external resources, depending on the type of resource and the level of security required.
For example, if you need to provide access to a website, you can create a user account with a username and password. If you need to provide access to a file or folder, you can create a shared folder or use a file-sharing service.
If you need to provide access to an application, you can create a shortcut on the desktop or in the Start menu.
The most important thing is to ensure that only authorized users have access to the resources they need. You can do this by using permissions and security settings.
Monitoring and responding to external threats
rganizations face a range of external threats, from natural disasters to cyberattacks. To protect their assets and employees, organizations need to monitor for these threats and have a plan in place to respond.
Organizations can monitor for external threats using a variety of methods, including physical security measures, such as security cameras and access control systems; cyber security measures, such as firewalls and intrusion detection systems; and social media monitoring.
When an external threat is detected, organizations need to have a plan in place to respond. This plan should include steps to evacuate employees and secure assets, as well as how to communicate with the public. The goal is to minimize the impact of the threat and keep everyone safe.
Improving your external attack surface management process
malware
-phishing
-ransomware
-social engineering
-spear phishing
-vishing
-watering hole attacks
-whaling