In this lesson,
we will learn about the Organizational Attack Surface.
The Organizational Attack Surface encompasses
the vulnerabilities associated
with an organization's external relationships
and its public facing digital footprint.
Organizational attack surface concepts include
the enumeration and discovery of third party connections
and the enumeration and discovery
of an organization's public digital presence.
The enumeration and discovery of third party connections
involves identifying and assessing
all external entities that have access
to the organization's systems or data.
The enumeration and discovery
of public digital presence focuses on mapping
the organization's online assets, including websites,
social media accounts, and publicly accessible systems
to identify potential exposure points that could be targeted
by an attacker.
Let's learn more about the enumeration
and discovery of third party connections and the enumeration
and discovery of an organization's public digital presence.
First, we have the enumeration
and discovery of third party connections involves
identifying all external entities such as vendors,
partners, and service providers that have access
to an organization's systems or data.
These third party connections extend an organization's
attack surface by adding external points of access
that if compromised could directly impact
the organization's security.
Identifying these connections allows an organization
to assess the security posture of the third party.
This is important because the third party security
practices may differ and a breach in one
of the third party systems could grant attackers access
to our organization's sensitive assets.
So third party connections present unique risks
that must be managed.
For instance, in the target breach of 2013,
attackers infiltrated the network
by compromising a third party HVAC vendor.
The vendor had access to target's network to manage heating
and cooling systems,
but once attackers are breached the vendor systems,
they use this connection to infiltrate target's
point of sale systems.
This allowed attackers to steal millions
of customers credit card details
and personal information
as customers swipe their credit cards at the target stores.
Third party breaches like this are particularly challenging
because they involve external parties making, monitoring
and managing access much more complex,
and highlighting the importance
of securing third party relationships.
To mitigate the risks associated
with third party connections,
organizations should regularly audit these relationships
to confirm that each connection
is still necessary and secure.
Tools like vendor security
and risk management software monitor vendor security levels
and provide insights into vulnerabilities
within these connections.
Additionally, implementing network segmentation
and zero trust principles
for third party access can limit the potential damage
from a compromised connection while automated
access revocation tools such as Okta Lifecycle Management
or Cyber Arc can ensure timely termination
of third party access when it is no longer needed.
Second, we have the enumeration and discovery
of an organization's public digital presence
involves identifying and mapping online assets
like websites, social media profiles,
and publicly accessible systems.
This process helps the organization understand
its external digital footprint
and spot potential exposure points
that attackers could take advantage of.
A complete digital presence inventory ensures
that the organization is aware
of all publicly visible assets, allowing it
to secure these points of exposure against a cyber threat.
An organization's public digital presence is highly relevant
to enterprise security
because it is the frontline facing external threats.
For example, a company may have several social media
accounts and web applications,
some of which might be outdated or misconfigured.
These exposed assets are prime targets for attackers,
who may try to exploit vulnerabilities in outdated software
or take advantage of neglected accounts
leading to brand damage, data theft,
or unauthorized system access.
So to protect an organization's public digital presence,
regular digital asset inventories
and security audits are essential.
Additionally, tools such as Shodan and Censys
can be used to scan the internet
for publicly accessible devices and services,
helping organizations to identify
and manage their external assets.
Next, setting up automated alerts for unauthorized use
of brand names and keeping all online profiles
and systems up to date can reduce the risk
of external exploitation.
Finally, conducting regular vulnerability scans
and penetration tests on public facing applications can help
identify and patch vulnerabilities
before attackers can exploit them.
So remember, the organizational attack surface includes
vulnerabilities linked to an organization's external
partnerships and its online presence.
Key areas of concern, our third party connections
and the organization's public digital footprint.
Third party connections involve assessing all vendors,
partners or service providers with access to company data
or systems, as these connections can increase the attack
surface if left unchecked.
Next, the public digital presence includes websites,
social media accounts, and other publicly accessible
systems, which must be mapped
to identify exposure points vulnerable to attack.
In response, regular audits, security tools,
and proactive monitoring help minimize the risks
associated with both third party connections
and public digital assets.