It’s hard to comprehend how hackers find ways to enter your network and cripple your business. While you may be focusing on other areas of growth for your company, you can’t leave a portion of your network unprotected and therefore accessible to bad hackers. Consider your attack surface and how to protect it.
The reality is, your company is more likely than not to be attacked. Data from the National Cybersecurity Institute found that half of all small businesses suffer cyber attacks of some type. What’s more alarming is that, of those, 60% end up shutting down as a result.
What is attack surface management?
Attack surface, according to the National Institute of Standards and Technology, is “a set of points on the boundary of a system…where an attacker can try to enter, cause an effect on, or extract data from.”
An attack surface is made up of these points, which can be system components or any environment within the network where there’s a risk that a cyber attack can occur. The goal of attack surface management, then, is to make that area as small as possible.
To provide a more visual picture, head back in time to the Battle of Thermopylae. In 480 BC, the Persian Empire invaded Greece through a small mountain passage. To fend off the invaders, the Spartans sent an army of 300 soldiers to block that road, which was thought to be the only way into the area. However, on the second day of the battle, a resident named Ephialtes informed the Persians of another path that would lead them behind Greek lines.
How does this relate to your attack surface?
In that battle, the Spartans were only defending that narrow opening. When that was the only area the Persians could enter, it was a very small attack surface. However, once they were informed of the existence of a “back door,” the Persians were able to expand their attack surface and get far deeper into the Spartans’ defenses.
Apply this same concept, then, to cyber security. If you have a very small attack surface, it’s easier to protect it. If you have fewer ways in then you are going to be more successful at keeping out the bad guy.
Cyber asset attack surface management’s role in your security defense
By reading this, you recognize the risks associated with cyber attacks. The key is to find a way to reduce them. Just as you do with other areas of your business, risk mitigation starts with a comprehensive view of where the risks are.
The following strategies should be a part of your cyber security risk reduction efforts.
#1: Remove unused software
About half of the installed licensed and unlicensed applications small businesses purchase go unused. Most organizations will have technology like this that’s dormant, whether it’s been replaced or never fully integrated.
Not only is that expensive, but the same survey found that just 5% of companies stated they had complete visibility into the number of software licenses they have or that employees use.
View each of these unused software products as gateways into your network. Getting rid of them could not only reduce costs, but it would also reduce the available attack surface your enemies can exploit.
#2: Close unused ports
Your devices have network-connected services that enable functionality like data transfer. They let applications connect to the services they need to work. And, as you’ve likely guessed, each of these ports is a threat to your company’s security.
The ports are numbered, and some of them are critical. For example, those who use Gmail, Apple Mail, or Outlook likely connect to port 25. That allows them to use SMTP to communicate. These protocols are secure, and you need some of them to operate.
However, if there are unused ports within your network, you’re creating unnecessary opportunities for threats. These are attack vectors, or ways for attackers to get into your system or network. Closing them off reduces your attack surface, making it less penetrable.
#3: Automatically shut down unused services
Be aware of the importance of “automatically” limiting risk as a factor. A study by the World Economic Forum found that 95% of all cybersecurity breaches are actually due to human error.
Even if you have top-of-the-line tech pros working for you, a mistake exposes you. That’s why having a process in place to automatically reduce these risks is key.
What are unused services? Some services, including remote access programs, web servers, and guest accounts, provide direct access to your network. Recursive domain name servers are another risk point. Since many of these unused services are entry points into your system that no one is really looking at, they present a big opportunity for cyber attacks.
Some of these programs will automatically activate when you reboot your system. Eliminating unnecessary startup programs from the get-go is wise.
#4: Set technological and policy controls
Attack surface can also be minimized by simply implementing some rules. Which users really need access to various programs? What do you want to limit access to? Better understanding these areas allows you to minimize risk.
To do this, develop a set of technological and policy controls, or rules, that help govern who gets access. But make them simple:
- Make sure your technical policies are not duplicated or redundant.
- Keep access rules active. If there are unused rules present, or rules that no longer serve a purpose, eliminate them.
- Tighten overly permissive rule definitions that may provide far too much access than is really necessary.
Complex networks with complex rules are far more difficult to manage (and often very challenging to navigate). Keep it simple to limit risks as a component of your cyber security risk management.
#5: Visualize the vulnerabilities present to mitigate them
Sometimes, the best way to implement cyber security risk reduction is to test it out. While you’re not going to open your network to big threats, you’ll want to incorporate a variety of strategies that can give you better insight into the big risks present.
There are a few ways to do this, and to do it well you should use multiple methods.
- Attack surface modeling: This is one of the best ways to see just how those risks could be exploited. Imagine a massive map on the wall that lets hackers see all of the entrance points they could access. Real-world modeling using your network assets, topologies, and policies allows for a clear view.
- Attack simulation: Any good role-playing game involves multiple tries to get to the target. In cybersecurity, penetration testing shows ways in which threats can be manipulated.
- Path simulation: This method allows you to focus your resources and efforts on the specific areas that could be risk factors.
Attack surface management has to consider the worst-case scenario: where are the threats, and how can we prevent them once we know about them?
#6: Prioritize the use of consistent analytics
Knowledge is powerful. The better the oversight and management of your network, the less opportunity for attack vectors to open. By having consistency in your analytics, you’re constantly monitoring for risks. When there’s a substantial change, you can then take action.
Some key data points to focus on include:
- Security configuration assessment: This is the process used to verify that all of the systems meet specific, predefined rules in terms of approved use and configuration settings.
- Quantitative risk scores: Statistical analysis and measurable data that help provide a way to monitor risks as they change are also vital. Changes in risk scores indicate that modifications to attack surface management may be necessary.
- Traffic flow analysis: Like a city planner changing a roadway in a busy community, traffic flow analysis helps you see where and how people are accessing your network, and when there are any anomolies, you can react quickly enough to prevent risks.
By incorporating these strategies, you’ll reduce cybersecurity attack surface risks considerably. Take the time to learn the key performance indicators you should be monitoring to protect your business.
Know the risks and work to prevent them
Cyber asset attack surface management is a critical component of protecting your business. Recognize the risk here. Should a threat occur, you could:
- lose data
- incur damage to your IT infrastructure
- see exposure to proprietary or sensitive data
- lose access to your system
- suffer reputational damage
You do not want to be one of the organizations that’s forced to shutter due to exposure to preventable risks.
At CloudFirst, we offer solutions to minimize attack surface and prevent invasions that put your business at risk. We provide a wide range of tools to help you, including ezHost, a highly protected service that isolates risks.
To learn more, download our free ebook, The Business Leader’s Guide to Cybersecurity and Data Protection Strategies.
