How Well Do You Know Your Attack Surface? Five Tips to Reduce the Risk of Exposure

In an increasingly connected digital landscape, the security of your organization's data and publicly facing assets is more critical than ever. According to the CrowdStrike 2023 Threat Hunting Report, more than 20% of all interactive intrusions are associated with the exploitation of public-facing applications. As an organization’s attack surface expands and cyberthreats proliferate, it is imperative IT and security teams take a proactive approach to safeguarding their digital footprint. This starts with implementing a strong exposure management program across the entire enterprise that drastically reduces all attack surface risks.

Do You Really Know Your Organization’s Attack Surface?

To stop an attack before it begins, you must first understand where critical exposures exist. You can think of your organization's external attack surface as all of the doorways through which an attacker might attempt to sneak in. This includes anything from domain names, SSL certificates and protocols to operating systems, IoT devices and network services. These assets are scattered across on-premises environments, cloud environments, subsidiaries and third-party vendors, and they represent many of the easiest entry points to internal networks and the sensitive data they contain.

Building a Successful Exposure Management Strategy with EASM

In an age where unknown entryways can lead to invaluable troves of information, external attack surface management (EASM) can find doors that may be left open. CrowdStrike Falcon® Exposure Management finds those potential access points before adversaries do.

Our EASM technology, as part of Falcon Exposure Management, uses a proprietary engine to continuously scan the entire internet, enabling organizations to see their attack surface from an adversary’s perspective. The digital footprint of an organization is simple to generate, using only a company’s root domain. Once generated, it gives security teams a complete view of all of their internet-facing assets, including those on-premises and in the cloud. All exposed assets are automatically classified, analyzed and rated with a contextualized risk score, allowing teams to fix first what matters most.

Reducing the size of your attack surface can minimize the risk of a breach. By following the five tips below, organizations can reduce the number of opportunities an adversary has, strengthen their cybersecurity posture and proactively protect valuable assets from malicious actors.

Top Tips to Reduce External Attack Surface Exposures

1. Do not allow Remote Desktop Protocol (RDP) connections from outside your organization’s networks

There are plenty of products and open source solutions offering remote access to company resources. When RDP is opened to the internet, it is often not monitored and is susceptible to attacks.

How:

• Stand up a server that sits outside of your network perimeter
• Install nmap or any other network scanner you’re comfortable with
• Grab a list of your IP ranges
• Set up a cron job to scan continuously for port 3389
• Grab the logs weekly
• Use this list to figure out the person inside your organization who owns or is responsible for each host that has responded on port 3389
  • Clues:
    • Domain name (if applicable)
    • IPAM IP range notes
    • Login banners
• For any hosts that MUST have RDP exposed to the internet, enable multifactor authentication (MFA), remove them from your scan script above and continue the process of scanning
• Use Network Level Authentication, a Remote Desktop Services feature that requires a user to authenticate before connecting to the server

2. Avoid allowing directory listing on your web servers

Directory listings expose the server to traversal attacks and a large variety of vulnerabilities. Moreover, the web server may contain files that shouldn't be exposed through links on the website. Ensure your server does not expose directory listings, and if it must, make sure the directories do not contain sensitive information.

How:

• Stand up a server that sits outside of your network perimeter
• Install nmap or any other network scanner you are comfortable with
• Grab a list of your IP ranges
• Set up a cron job to scan continuously for open HTTP
• Grab the logs weekly
• For every host answering on an HTTP or HTTPS port, use this list as an input for your web app scanning tool of choice (such as nikto or dirsearch)
• For any host allowing directory traversal, figure out the person inside your company who owns or is responsible for this website
  • Clues:
    • Domain name (if applicable)
    • IPAM IP range notes
    • Login banners
    • Other website info

3. Place test environments behind a VPN

Ensure none of your development, staging or test environments is exposed to the internet. These environments are often not well-secured and in many cases have access to restricted resources.

How:

• Identify all of your production environments:
  • Have a clear list of domains and IP ranges from IT admin, content delivery network providers and web application firewall providers
  • Query whois reverse search under your organization name (there are multiple vendors and open source tools for this)
• All other environments (domains, subdomains and machines with external-facing IPs) should be protected with a VPN and MFA

4. Avoid hostile subdomain takeovers

Confirm none of your subdomains is expired or points to third-party pages and accounts that no longer exist, as it might be vulnerable to hostile subdomain takeovers. If you find such subdomains, reconfigure the DNS settings or remove the DNS entry pointing to the external service.

How:

• Talk to your IT admin team and get access to your DNS (may be route53, may be self-hosted)
• Do a zone transfer on all of the domains your organization owns
• Get a list of all of your IP ranges
• Parse the IP addresses against your known IP range list
• For any IPs that aren’t part of your infrastructure, figure out who they belong to (whois lookup, published list of cloud provider IP ranges)
• Determine if they are pointing at anything you know you own
• Any unused subdomain should be retired properly:
  • Use “Null MX” record
  • Use DMARC configuration to prevent any email from being sent on behalf of the sub/domain

5. Enforce input validation

Enforce input validation on all internal and external inputs to prevent injection attacks. Input validation best practices include: predefining input size limitation per field and type (str/int if applicable), applying maximum retries for password and user fields, and enforcing backend strict logic to prevent injections (prepared statements with parameterized queries, stored procedures, escaping all user inputs, etc.).

How:

• Follow the OWASP input validation cheat sheet
• Assume all external user-defined input is an attack surface:

• • Forms fields
  • Uniform resource identifiers (URIs)
  • APIs
  • Attachments
  • And more

Bonus Tip: Continuously monitor your attack surface

Securing an expanding attack surface is challenging. The dynamic nature of most modern IT ecosystems means secure assets can suddenly become exposed unknowingly due to an error, misconfiguration or simple oversight. This category of forgotten assets can grow for many reasons: employees with revoked access, engineers with lingering cloud token permissions, or unmaintained databases that should have never been exposed in the first place. Moreover, there are instances of abandoned assets that remain unused or unclassified for extended periods, leaving IT departments without records and, consequently, unable to secure them. Regardless of their origin, these assets present significant security risks.

Having an effective exposure management program enables teams to stay vigilant and proactively  monitor and secure entire IT ecosystems, which is essential in safeguarding an entire attack surface. You need to add a scalable way to monitor your internet-facing assets and discover your unknown exposures and risks in real time.

Additional Resources

• Tune in to our October CrowdCast, “Shut Down Adversary Opportunities with Proactive Exposure Management,” and learn about the rest of our upcoming series.
• Want to learn more about Falcon Exposure Management ? Visit the Falcon Exposure Management product page.
• Download the Falcon Surface data sheet to learn more about our EASM technology.
• See for yourself how the industry-leading CrowdStrike Falcon platform protects against modern threats. Start your 15-day free trial today.