The very elements crucial for a business’s functionality and prosperity are also its greatest vulnerabilities from a cybersecurity standpoint. Emails, files, remote/hybrid work setups, and various devices and tools streamline business operations but also pose significant cybersecurity risks. These areas, where external factors come into play, are the least secure, representing vulnerabilities in your organisation’s attack surface.. Adding to the complexity, this surface is constantly changing, evolving with your business and the environment in which you operate.
Defining an attack surface
Simply put, an attack surface encompasses all vulnerabilities that can be exploited by attackers to enter a network. This includes physical vulnerabilities, such as a USB port where someone could plug in a malicious USB stick while an employee is away from their computer. It also includes network vulnerabilities, like open or unprotected ports, unpatched software, and avenues for phishing or social engineering attacks.
Attack Surface Hotspots
Typically, the attack surface hotspots within your IT infrastructure tend to be where end users interact with it, as these portions of the network, by design, must remain more open so as to not hinder functionality.
Therefore, keeping open access to internet browsing for employees in most roles (such as those working or studying in educational institutions, to give just one example) is acceptable and encouraged, because of the net positives it creates. However, if individuals are browsing the web unimpeded, they run the risk of clicking on a malicious link – particularly without the right training or controls in place.
Front-facing content such as an organisation’s website is another potential place where organisations remain vulnerable on the attack surface, as malicious activity deployed here (such as malvertising) could cast a wide net in terms of potential victims.
Vertical and size challenges
Managing the attack surface appropriately will vary from vertical to vertical, and depending on the size of your business. Larger businesses by nature of multiple sites, departments, and a general diversity of business activity will naturally have a more complex attack surface.
In industries like financial services, the ability to access fast and flexible digital transactions, especially given the global nature of commerce, can determine the success or failure of a business. However, this necessary flexibility may come at the expense of security, in a vertical which is consistently ranked top (or close to top) in terms of the most targeted sectors.
This speaks to a wider issue, regarding the security supply chain. Industries such as financial services have effectively needed to redesign their entire business structures in order to keep up with the pace of digitalisation. While financial services have managed to do this effectively and for the most part safely, other industries may not be as successful in managing a rapidly changing attack surface. Organisations involved in manufacturing for example may be working across legacy equipment, created for a manufacturing environment which in many cases predates the Internet completely. Now, as they digitalise, their attack surface has changed beyond all recognition, and if they have failed to secure it, then they leave themselves open to serious cybersecurity incidents.
An intelligence-powered solution
The core advice for protecting the attack surface remains simple: Consider security from the very beginning. Ensure that everything in your network is angled toward reducing the available attack surface as much as possible, without impeding business function.
Where there is necessary risk in order to support wider activity, ensure that this risk is minimised. This can be done by ensuring that security awareness training programs are in place, vulnerabilities are regularly scanned for, and that patches are regularly and rigorously applied. Leveraging relevant threat intelligence is crucial to enhancing your security team’s ability to thwart malicious activities that may target your attack surface. Given that many cyber incidents are fueled by readily accessible intelligence, a comprehensive understanding of threat intelligence is a critical advantage.
