In part 1 of this series, we covered a lot of ground including the three converging trends that point to the need for an attack surface management (ASM) solution – the growing attack surface, attackers having more opportunities and tools to infiltrate the attack surface, and manual SecOps being slow and ineffective. We also outlined the key features you should be looking for when selecting an ASM tool. In part 2 here, we take it forward to discuss how you should choose and get started with an ASM platform. We also highlight the key features of IONIX that make it worthy of your consideration. Let’s get started.

Before we dive in, let’s agree on our definition of attack surface management. To quote from part 1, “ASM is the process of defining and securing your organization from the outside in.” ASM is a critical part of a broader CTEM (continuous threat exposure management) strategy.

How to choose an ASM platform: 

Here are the top features you should look for when comparing attack surface management vendors:

1. End-to-end discovery of assets

With the proliferation of assets in an organization’s digital estate, it’s easy for vendor-managed or digital supply chain assets to fly under the radar. These are easy pickings for attackers. The solution is to find an ASM tool that can uncover even the hard-to-find assets. This includes things like digital supply chains, and assets that are not in use any longer such as old storage buckets. 

Attack surface discovery should lead to a high level of confidence about whether an asset belongs to your organization or its subsidiaries or partners. This is possible with multi-factor discovery and attribution and is something you should look for when selecting an ASM solution. 

2. Evaluation of Assets 

The next step is to understand the vulnerability of the assets involved, and how they are configured or misconfigured. As assets are interconnected, a vulnerability that affects one asset could easily affect other assets. 

Consider the three S’s: 

• Scanning: Continuously scanning the connected assets and ensuring an accurate view of all assets especially as assets change, get retired, and are added on a daily basis.

• Seeing: Make sure you see all new assets as soon as they are added to the system and perform a risk assessment of these assets to determine if any are exploitable. The best ASM platforms use multi-factor authentication to provide discovery evidence and ensure that every new asset that is scanned and seen actually belongs to your organization.

• Suspending: To avoid the increase of unnecessary assets like third-party applications, identify old assets that are no longer in use and should be retired or suspended. This helps reduce the attack surface and will minimize the potential for further risks. 

The key here is to notice how assets are connected with each other.

3. Prioritize the connected assets

Having an inventory of all assets and how they are connected is just the beginning. What you really need is a map of all assets that highlights which ones are exploitable. This map should also show you the blast radius of any vulnerability. Armed with this insight you can perform risk prioritization based on their actual potential for damage. The ASM platform you choose should automatically rank and prioritize risks for you so SecOps teams don’t waste time sorting or filtering the list of vulnerabilities.

4. Bring remediation down to minutes or hours

Typically, MTTR in traditional vulnerability management is as much as many months. This is too slow for a world where attackers work at the speed of AI. Instead, the ASM tool you choose should bring MTTR down to minutes or at most hours. There’s more than one way to do this.

First, the ASM tool should be able to cluster similar issues. For example, there may be a single vulnerability that affects several assets, and this vulnerability can be fixed with just one patch or upgrade. Second, use simple words to describe issues, and make sure to use the same terminology across teams. This might sound simple, but it can save a lot of time by reducing communication gaps. Third, ensure your security tooling is well integrated. This means connecting your ASM platform to other security systems like SIEM and SOAR or other ticketing systems. 

5. Automated protection of assets

The final step is to take action on the vulnerability based on the intelligence gathered from all the previous steps. When choosing an ASM tool, look into the kind of protective measures it takes to protect vulnerable assets. Look for ways the ASM tool automates this protection, so the asset is protected before an attacker gains access to it. 

By ensuring these requirements are met, you can avoid many common mistakes in attack surface management. Now that you know how to compare attack surface management platforms, the first few days are important as you get started using the platform. 

Getting started with an ASM

Here is what you should expect as you get started with an ASM platform:

Quick setup & initial results

The setup for the ASM tool should be simple and be done in just a day. The tool should start discovering all your assets and give you the first report on day one. It should allow you to take action to fix issues on the same day. It could take a few days for deeper and more comprehensive coverage, but it should produce results right from the get-go.

Transitioning from vulnerability management

If you’re already using a traditional vulnerability management solution, it would take some time to adapt to an ASM platform. There would be more data to deal with, and a new product interface to adapt to. However, a well-designed ASM product should be intuitive to use. It should show you the most important data as soon as you log into the tool, and should not take too many clicks to drill down to specific issues.

Training & onboarding for SOC team

To ease your transition to the new ASM platform, it would require some training for the SOC teams and other teams that would be using the platform. It helps to show each team the dashboards and metrics that matter to them most at the start. 

Now that we’ve discussed best practices for choosing and getting started with an ASM platform, let’s look at IONIX’s approach to ASM.

IONIX – ASM the way it should be

IONIX’s approach to discovering and matching assets is strategic. With its deep discovery of assets, IONIX helps you discover 50% more assets than traditional vulnerability management solutions. To keep up with your constantly changing digital estate, IONIX leverages machine learning to discover new domains, subdomains, and IPs.

Asset discovery does not end there, though. It should map the connections between assets and present them in a visual map. 

It looks at connections between the assets to show you exactly what your multi-layered digital supply chain looks like. 

Further, our solution categorizes assets and risks based on their types – Web, DNS, SaaS, and IP…. Our ASM solution also tells you which assets belong to your partners, or individual subsidiaries within your organization. This gives you a high level of confidence in the quality of security data being reported and in the alerts being generated from them.

The benefit of deeper asset discovery is that it can minimize alert noise and only surface alerts worth your attention. IONIX’s multi-factor discovery & attribution as described above significantly improves alert quality.

Exposure validation:

Rather than chase every vulnerability down a rabbit hole, you need to focus on just the exploitable risks. These risks are confirmed to allow attackers access to the system. While discovery and evaluation of assets give you the ‘lay of the land’ exposure validation tells you which risks are exploitable and need attention right away. 

IONIX uses simulated tests to check assets and find only the ones that are exploitable. Our platform uses non-intrusive methods to validate exploits and ensures the entire process is run in stealth mode. The benefit of this is that you can be sure that IONIX will never impact the performance of your production systems or introduce new vulnerabilities.

Further, IONIX performs this validation in a continuous manner, at regular intervals, ensuring it keeps pace with all the changes in the list of assets. Going beyond CVE and CVSS scores, IONIX’s Exposure Validation actually simulates exploitability. All this comes together to enable you to prioritize and focus only on exploitable risks in your system. 

Remediation and mitigation: 

As threats increase and evolve faster than ever, you need an ASM solution that can keep pace. That’s what we’ve built in IONIX. Our platform provides Active Protection so your attack surface is always protected.

IONIX takes into account data breach information from the deep and dark web and correlates it to your organization’s systems. If any breach has been found that affects your systems or assets, it can automatically inform you and take remedial action on the affected assets. 

Further, our ASM solution provides an ordered workflow of tasks (or a blueprint) that your SOC teams can keep handy and check-off one-by-one in order of priority. No more second guessing where to start, or which task to move on to next.

We know that security teams don’t rely on a single security tool anymore, that’s why we’ve built IONIX with the ability to integrate with any existing security tooling you use. This could be your ticketing systems, SOAR, SIEM, and APIs. As these systems are connected, it reduces the time taken to mitigate issues. Teams see the same data across multiple systems, and they need not constantly switch context between security tooling. IONIX makes sure it’s all organized and ready to act on.

If you decide to go with IONIX, your first few days and weeks with the platform are important. At IONIX we put a lot of thought into the onboarding process to ensure you get the most out of the platform.

What you should do once you start with an ASM platform

Beyond the initial setup phase, here’s what you should be spending your time on when using an ASM platform:

Remediate your biggest risks

IONIX gives you the total number of risks within your system, and prioritizes the risks based on their exploitability. This will help you get started to fix your biggest issues right away. You can keep moving down the list of issues and make great progress in no time.

Define standard operating procedures for teams

As you remediate risks, it is essential to capture the learnings from them and incorporate them into your day-to-day operations. Define standard operating procedures for asset creation, management, and retirement. Use IONIX’s reports to track and assess who created an asset, when it was created, which assets should be retired, and more. 

Set new records for MTTD, MTTR

With better SOPs and runbooks, you’ll soon be surprising yourself with how quickly you can detect a new issue, and even more, how quickly you remediate it. 

Wrapping up

An ASM is a powerful solution that can change the way SecOps functions in your organization. It offers solutions to longstanding problems related to the attack surface and your organization’s security posture. In this article, we covered how you can get started with an ASM solution, why IONIX is the ideal choice, and what ASM means for your security teams and processes. If you’d like to go further in this journey of securing your attack surface, reach out to us, we’d love to discuss your unique requirements and see how IONIX can meet those needs immediately.