Attack Surface Management

Problem today

Organizations are overseeing a fast-growing ecosystem of devices, tools and assets on their networks — all of which are proliferating rapidly. Yet they have limited visibility into this expanding digital universe.

More than half of IT professionals Ivanti surveyed say they are not very confident they can stop a damaging security incident in the next 12 months. And more than 1 in 3 say they are less prepared to detect threats and respond to incidents compared to one year ago.

Why it matters

The problem is not simply a matter of complexity (i.e., the proliferation of devices and assets leading to sprawl and inefficiency). This growing ecosystem is driving an ever-expanding array of vulnerabilities and exposures, which can lead to data breaches, downtime, noncompliance, reputational risk‌ and much more.

For these reasons and more, attack surface management (ASM) is now a mission-critical part of cybersecurity defense. (And Ivanti’s research shows increasing investments in ASM.)

ASM strategy supports continuous discovery and visibility into emerging threats and active exploits, as well as a data-driven method to prioritize and manage vulnerabilities.

As attackers grow more sophisticated, organizations must face these threats by planning and strategizing from the perspective of their adversaries: Where would an attack begin? What systems would be breached first? How would the attack unfold?

Set priorities, harmonize data and leverage automation

In today's digital landscape, we're redefining what constitutes an asset. It's no longer just about physical devices. A myriad of asset types are emerging — transforming closed networks into open systems running on IP protocols. This shift has significantly expanded the "blast radius" for organizations of all sizes, exposing them to increased risks due to misconfigurations and internet exposure. 

I recommend following a principle called DEER: Discover, enumerate exposures, remediate. 

The real challenge to the DEER principle is the sheer amount of data organizations must harness and leverage. On average, every organization has 60 to 70 different sources of data coming at it. There are five things an organization needs in order to effectively manage all this data:

1. The ability to ingest the data.  
2. The ability to normalize the data.  
3. The ability to label the data.  
4. The ability to prioritize the data based on an attacker's intent.  
5. An understanding of what the organization’s priorities are. 

Once you have a clear prioritization, you need to build up a very robust remediation strategy. And each step of this can be done as a shift-left (which is developer-centric) or shift-right (which is security-centric).

Next comes automation, where service management can come into play. Develop automated workflows for device management, as well as writing tickets to developers, ops and security teams. Then create automated workflows to ensure that remediation is happening with very little human intervention.

Dr. Srinivas Mukkamala
Chief Product Officer, Ivanti

Identify supply chain vulnerabilities and make them part of the calculus

Organizations need to pay more attention to supply chain and vendor security. To do it effectively, consider adopting these four directives: 

1. Establish clear vendor security requirements that align with organizational policies and comply with industry regulations such as GDPR and HIPAA. These standards should be clearly communicated to all vendors and suppliers. 
2. Conduct thorough risk assessments of your vendor ecosystem to understand how well each supplier meets security requirements today. Conduct regular audits and compliance checks to ensure ongoing adherence. 
3. Make sure vendors are an integrated part of your incident response plan (IRP), especially if they have access to your organization's systems and data. This will ensure there’s a predefined process for managing incidents involving vendors. 
4. Ensure that security measures are incorporated into contractual agreements with vendors, to hold them accountable and ensure a mutual understanding of each party's role in maintaining security. 

Above all, your approach with vendors should be collaborative, encouraging regular communication about potential threats and ways to improve security measures together.

Daren Goeson 
Senior Vice President of Product Management, SUEM, Ivanti

Keep in mind: sophisticated attack surface management is dynamic above all else

Organizations need to understand emerging external risks — particularly those unique to their specific industries and markets — and how those risks interact with internal vulnerabilities.  

You cannot evaluate risk without context. Your security team may find a vulnerability in a supplier’s software that’s a “5” (i.e., medium). Not so bad. But an attacker may discover it and think, “that’s only a 5, but if I pair it with this other vulnerability, I now have RPE capabilities." 

Attack surface management software and prioritization have to take into account the dynamic nature of each vulnerability and each finding that's out there. As vulnerabilities morph and trend, or if they get tied to ransomware or get exploited, an ASM solution will identify how to drive and change those prioritizations dynamically. 

The state of our software changes daily, but some of those may not be implemented internally. Somebody else can influence and change our attack surface by exploiting a minor defect — and that suddenly becomes a top priority. So, good attack surface management is highly dynamic, plugged into trends‌ and continuously reevaluating risk based on new data.

Rex McMillan
Vice President of Product Management, Ivanti

This report is based in part on two surveys conducted by Ivanti in late 2023 and 2024: “2024 Everywhere Work Report: Empowering Flexible Work” and “ 2024 State of Cybersecurity: Inflection Point”. In total, these two studies surveyed 15,000 executive leaders, IT professionals and office workers. This report also cites research from third-party sources.

^{*Gartner, Mitigate Enterprise Software Supply Chain Security Risks, By Dale Gardner, 31 October 2023 GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.}