The pandemic of COVID-19 has changed the world dramatically. Almost all everyday actions have gone online: people work from home, students attend lectures through web conferences, cafes and shops offer online delivery and there are much more such examples.

Literally the whole world lives online.

Such a way of living has its pros and cons. The latter, among others, includes the increasing probability of cyber attacks. Shodan stated RDP and VPN use skyrocketed for over 41% and 33%, respectively, since the onset of the coronavirus (COVID-19) outbreak. And we can assume that the more internet growths, the more vulnerable it becomes. Cybersecurity Ventures’ research shows that cybercrimes are likely to inflict damages in the amount of $6 trillion USD in 2021. That would be the third largest economy in the world (after the US and China), if we talked in the context of countries. By 2025 this amount is expected to rise up to $10.5 trillion USD annually. Such figures are astonishing!

When it comes to cyber defense, the concept of attack surface analysis becomes the basic one, this is where everybody should start from.

Attack surface definition

Attack surface is the entire environment of your infrastructure. In simple terms, the definition of attack surface comprises all possible digital and nondigital assets that might be compromised by malicious actors.

According to the RiskIQ research, about 2 500 of the Alexa top 10 000 domains have at least one potential vulnerability. In most cases these weak points remain unnoticed. But in order to the data found via Spyse search engine, it seems like the level of threat is significantly higher. At least 3 000 domains from Alexa 10 000 have medium and almost 1 000 have High severity vulnerabilities potentially exploitable by hackers.

Attack surface analysis is a key to reducing the possibility of cyber attacks. It helps to detect what parts of your digital environment are open in the open source, what needs to be sealed and reviewed. By finding out the risk areas, it is easier to protect the whole system.

Types of attack surfaces

Attack surfaces can be divided into two categories – digital and human ones.

Devices which are connected to the Internet are exposed to cyber attacks. This creates digital loopholes for intruders. That’s why all networks, applications, ports and other elements of your digital infrastructure need to be properly protected and regularly analyzed.

But not always the problem is in the digital part – the human factor is a more sophisticated and unpredictable point in cybersecurity. You can’t avoid all mistakes made by people. Quiet often hackers target employees with a view to gaining access to confidential information. This technique is called “social engineering”. It is important to restrict access to data except for a limited number of people who are duly aware of possible cyber manipulations.

Attack surface reduction strategies

The good news is that there are many ways to protect your attack surfaces and get ahead of possible intruders.

Speaking of the human aspect in attack surface management, the answer lies in cybersecurity training and proper cybersecurity management that separates access to the data between different departments and people.

In the case of the digital side, here are a few ways to reduce the attack surface of your complex infrastructure and limit the opportunities available to cybercriminals.

1. Understand and Eliminate Complexity

   Remove unnecessary complexity of your cyber infrastructure. The less assets you have the less you should take control. It will help to eliminate the possibility of human mistake, time, and money needed for maintenance.

2. Segment Your Network

Having a perimeter around your network is not enough, one simple breach and you are done – attacker freely travels around your network. Separate different departments, control points, and services.

3. Visualize

Create a real model of actions that potential attackers would try to utilize according to your security state. Such data will always lead you to new findings and deeper understanding of the level of threat.

4. Control Your Endpoints

Understand and take control of all what’s happening in your infrastructure. The best thing you can do here is utilizing asset management systems for monitoring changes in the infrastructure.

5. Prioritize

It’s simple as it can be, determine the attack surface reduction key points. Move from the most critical threats to the least setting up cybersecurity management on each level of your organization.

Cybersecurity reduction tools

There are many highly specialized tools developed to do just one thing whether it’s detecting, analyzing, or so. Covering them is not reasonable(as there are tons of them in google) so it is better to concentrate on services that do everything at once.

Further explanation will be based on Spyse service because of its simplicity and ability to get subscriptions without annoying sales calls etc.

Spyse provides information instantly in an already structured view and with ready-made conclusions, what’s best for quick infrastructure overview and detecting what parts should be sealed from public view.

As mentioned before, it crawls not just one infrastructure but globally what allows to check infrastructures of third-party organizations. This feature is presented by very few companies but it seems really important to understand the security level of your vendors and service providers to avoid potential threats from the outside.

Attack surface analysis starts from searching by your digital assets whether it’s domain or one of your IPs.
Right from the first screen it presents structured data and quick conclusions about the website you are searching for. Such conclusions will help to see some business infringements such as domain takeover or fake websites that are running along with yours.

Further, you can obtain the whole size of your infrastructure, technologies, website details, current certificate and potential security issues based on all gathered data(see the next screen).

Another part related to business infringements is exposed company’s emails. Pretty useful for those who are aware of phishing.

Further, you could take each IP address connected to the domain name and go on a long trip studying your network layers, subnets, open ports and banners you are sharing freely.

It might be a long trip, but still, it’s not that painful as it used to be because of how the data is presented. Now you don’t need to scan each asset, put it in a large spreadsheet, and try to match all of them. You just have it, all technologies on ports, what you share in banners, and what certificates expired or about to expire soon.

All this data will help you to be aware of what’s going on with your infrastructure, but no matter how much information you find with Spyse, use other, more specific tools when you get deeper into the analysis.

There is also a really important thing that’s missing in this tool. It lacks the monitoring feature that would help to detect all new exposed assets and potential threats related to the cyber infrastructure. If someone from Spyse is reading – users would really love it.

Also, Spyse creates the ability for getting marketing insights analyzing world trends or competitors. For example, analyze hidden competitors’ subdomains to predict potential changes and updates or investigate them to know how different organizations connected on the network level.

For now, Spyse database comprises 25 TB of information about Internet assets which contains almost all information from the internet. Even if they didn’t scan some domains, it will run the live scanning and add it to the database.

Searching by your digital assets you get a structured dashboard with information about the domain, IP, potential risk zones, and some ready-made conclusions such as a security level rate on the basis of the CVEs detected on your servers.

To get a sense of how it works, you can simply try Spyse for free and find out how it can help secure your security posture. Let your attack surface be secure.