Don’t overlook attack surface management

When it comes to securing cloud computing environments, one key aspect often goes overlooked: attack surface management (ASM). Why? Many cloud security training programs, including specific cloud provider certifications, don’t focus on it. Instead, they focus on specific tools and hyped trends, which are only part of cloud security.

Also, with the ongoing cloud security skills shortage, we’re no longer being picky about the cloud security talent that we onboard. Attackers are getting better at what they do and now can weaponize artificial intelligence technology against you. This could turn into the perfect storm that leads to another round of breaches that hits the 24-hour news cycles and sends a company’s value into the dirt.

Long story short, enterprises must recognize the importance of minimizing their attack surface—the vulnerable points that attackers can exploit. They do this by implementing robust ASM practices. With a little knowledge, businesses can fortify their cloud defenses and safeguard their valuable assets from the threats we know are out there.

Understand attack surfaces and why they’re important

Cloud computing introduces unique security challenges due to its distributed nature and shared responsibility model. The attack surface in the cloud is expansive, encompassing various layers and components. It includes not only the cloud infrastructure itself but also the applications, APIs, virtual networks, Internet of Things devices, mobile access, user access controls, and much more. Each element represents a potential entry point for attackers, highlighting the need for a proactive understanding of these entry points and how to reduce as much risk as we can.

ASM plays a pivotal role in cloud security by enabling organizations to identify and mitigate vulnerabilities effectively. The core idea is not to play a reactive game of Whac-A-Mole but to act in a proactive manner where ASM is built within the architecture and not an afterthought, as is often the case.

If you take any of my lessons about security to heart, remember this: Security must be systemic to everything or else it will be ineffective.

Let’s look at three aspects of ASM that you should consider today:

Visibility and discovery. Attack surface management should provide a comprehensive view of the cloud environment, allowing organizations to identify potential security weaknesses and blind spots. It helps uncover unknown assets, unauthorized services, and overlooked configurations, offering a clearer picture of potential entry points for attackers.

This is often referred to as security observability or having a true and complete understanding of what’s going on. Companies should be able to obtain meaningful insights, not just rare and meaningless data, aka noise.

Risk assessment and prioritization. By understanding the scope and impact of vulnerabilities, organizations can assess the associated risks and prioritize them. Attack surface management empowers businesses to allocate resources efficiently, focusing on high-risk areas that could have severe consequences if compromised.

For example, most people in IT will talk about total security for every IT asset. The reality is that a breach that exposes sales data is perhaps less impactful than one targeting personally identifiable information in health data. Of course, what’s important depends on your business and the industry you’re in.

Remediation and incident response. When vulnerabilities are detected, ASM management provides the necessary insights to remediate them promptly. It facilitates incident response by helping organizations take immediate action, such as applying patches, updating configurations, or isolating compromised resources.

Incident response means that you’ve failed to deter an attack, you’ve been attacked, and now you have to minimize damage and ensure that future access is denied. Often, we spend so much time protecting against attacks that we neglect planning what to do if we’re the victim of a successful attack. You only need to look at the number of enterprises that paid up in ransomware attacks to understand why this should be a greater priority.

How to get better at ASM

Often when I speak about ASM (or other security best practices and concepts), I can see the switches turn off in people’s brains. After all, we’re discussing a concept that is fundamental to all IT security not just cloud computing, something that’s been taught in one form or another for decades. 

However, the stakes are much higher now. Cloud computing is systemic to most net-new IT solutions, thus the impact of a breach is greater. Also, those who would do us harm have better tools, including cloud-based attack engines that are now powered by advanced AI technology. They are getting better at attacking, and thus we must get better at defending.

Embracing ASM as an integral part of cloud security is no longer optional—it’s a necessity. As the cloud landscape continues to evolve, organizations that prioritize attack surface management will stay ahead of the curve, ensuring a robust defense against ever-evolving threats. Remember, in the cloud, security is a shared responsibility, and effective attack surface management is a key element of maintaining a secure and resilient cloud infrastructure.