ไทย
English
As organizations increasingly adopt Cloud, SaaS, APIs, Remote Work, and third-party services, the number of Digital Assets and connection points they need to manage continues to grow. At the same time, some Assets may be created, modified, or exposed to the Internet without the Security Team being immediately aware, causing an organization’s Attack Surface to constantly evolve.
Attack Surface Management (ASM) helps organizations continuously discover, understand, assess, and monitor areas that could potentially be exploited as attack vectors. It enables Security Teams to understand what exists within their environment, what is exposed, where risks are located, and which areas should be addressed first.
In this article, BMSP explains how ASM works, its role in improving security visibility, and the key differences between ASM and EASM.
Table of Contents
What Is Attack Surface Management?
Attack Surface Management (ASM) is the continuous process of discovering, analyzing, prioritizing, remediating, and monitoring an organization’s Attack Surface.
It helps Security Teams identify Assets and Exposures that attackers could potentially use as entry points into systems. ASM also emphasizes the discovery of Unknown Assets, Unmanaged Assets, and Shadow IT that may fall outside the Security Team’s visibility.
Examples include temporary Cloud Instances created by Development Teams, test environments that remain active after use, old Subdomains without clear ownership, or Applications deployed without going through established IT processes.
A key objective of ASM is to reduce Blind Spots and provide a more accurate and up-to-date view of an organization’s actual Attack Surface.
How Does ASM Complement Vulnerability Management?
Vulnerability Management remains an important component of Cybersecurity. It helps organizations identify, assess, prioritize, and remediate vulnerabilities across their systems.
However, the effectiveness of Vulnerability Management partly depends on whether an organization already knows that an Asset exists and has included it within the assessment scope.
The challenge arises when Assets are unknown to the organization, such as Shadow IT, temporarily created Cloud Resources, forgotten Subdomains, or systems inherited through mergers and acquisitions. If these Assets are not included in the Asset Inventory, they may never enter the Vulnerability Management process in the first place.
ASM helps provide visibility at an earlier stage by identifying Assets and Exposures that may otherwise remain undiscovered. These findings can then be analyzed, assessed, and incorporated into the broader risk management process.
Simply put, ASM helps organizations identify what needs to be assessed, while Vulnerability Management focuses more deeply on vulnerabilities and Security Weaknesses within Assets that are already in scope.
How Does Attack Surface Management Work?
Attack Surface Management is not a one-time activity. An organization’s Attack Surface can change continuously as new Applications, Cloud Resources, Domains, APIs, and Services are introduced, or when configurations of existing systems are modified.
Although the exact process varies between solutions, ASM can generally be explained through five key stages: Discover, Analyze, Prioritize, Remediate, and Monitor.
1. Discover – Identify and Discover Assets
The first step is to discover and collect information about Digital Assets associated with the organization.
These may include:
- Domains
- Subdomains
- IP Addresses
- Web Applications
- APIs
- Cloud Resources
- Servers
- Endpoints
- Internet-facing Services
Discovery is not limited to Assets already recorded in an Asset Inventory. It also includes Assets that the Security Team may not have previously known about, such as Shadow IT, legacy systems that remain active, or Assets without clearly defined ownership.
This stage provides organizations with broader visibility into their Attack Surface and helps reduce Blind Spots that could become security risks in the future.
2. Analyze – Analyze Assets and Exposures
Once Assets have been discovered, the next step is to understand what each Asset is, which systems it is associated with, how it is exposed, and whether any Exposure or Weakness requires attention.
The analysis may include information such as:
- Vulnerabilities
- Misconfigurations
- Open Ports
- Exposed Services
- Software Versions
- Certificates
- Unnecessary active Services
Technical information alone is not enough. The context surrounding each Asset is also important.
For example, organizations should consider whether the Asset is part of a Production System, whether it processes sensitive or critical information, and whether it can be accessed directly from the Internet.
3. Prioritize – Prioritize Risks
When an organization has a large number of Assets and Exposures, treating every finding with the same level of urgency may not be an effective approach.
ASM therefore helps Security Teams prioritize risks by considering multiple factors, such as:
- How exposed the Asset is
- Its importance to the business
- The potential impact of an attack
- The severity of the identified risk
The goal is to help Security Teams focus their resources on the most important risks rather than treating every Alert or Finding with equal priority.
4. Remediate – Remediate and Reduce Risk
Once priorities have been established, the relevant teams can take appropriate remediation actions based on the type of issue identified.
Examples include:
- Patching vulnerabilities
- Correcting Misconfigurations
- Closing unnecessary Ports or Services
- Decommissioning unused Assets
- Restricting access privileges
- Implementing additional Security Controls
ASM can therefore help turn discovered information into actionable Remediation, including assigning Ownership and tracking the status of identified risks.
5. Monitor – Continuously Monitor the Attack Surface
An organization’s Attack Surface can change every day. Continuous Monitoring enables organizations to detect new Assets, system changes, and newly introduced Exposures.
Examples include a newly created Subdomain, a new Cloud Resource, a new Public IP Address, or a Service that has recently been exposed to the Internet.
Continuous Monitoring helps ensure that Attack Surface information does not become a static snapshot from a single point in time, but instead reflects changes across the organization’s Environment more effectively.
How Does ASM Help Discover Unknown Assets and Shadow IT?
One of the key challenges addressed by Attack Surface Management is simple: an organization cannot protect what it does not know exists.
An Unknown Asset is an Asset associated with the organization that is not recorded in the Asset Inventory or is not currently under the Security Team’s management.
Shadow IT, meanwhile, generally refers to Applications, Systems, or Services that are introduced or used without going through established approval or governance processes from the IT or Security Team.
For example, a Development Team may create a Cloud Instance for testing and fail to shut it down after use. A Marketing Team may create a Subdomain and connect it to a third-party service without notifying the Security Team.
ASM can collect information from multiple sources to help discover these Assets and associate them with the organization. The discovery methods used may vary depending on the type of Attack Surface and the capabilities of each solution.
For Assets exposed to the Internet, organizations can also use an Outside-in Discovery approach to identify Assets and Exposures from an external perspective.
This is an important concept within External Attack Surface Management (EASM), which focuses on increasing visibility into Internet-facing Assets and discovering external Assets that an organization may not know exist.
What Is the Difference Between ASM and EASM?
When discussing Attack Surface Management, another term that frequently appears is External Attack Surface Management (EASM).
In general, ASM can be viewed as the broader concept of managing an organization’s overall Attack Surface, while EASM specifically focuses on the External or Public-facing Attack Surface.
The key distinction is that EASM attempts to view the organization from an external perspective and identify which Assets or Services are visible to outsiders, even when those Assets are not included in the Security Team’s existing Inventory.
EASM is therefore particularly useful for discovering Unknown Assets, Forgotten Assets, Shadow IT, and Exposures across the External Attack Surface.
However, EASM does not replace Vulnerability Management, Endpoint Security, or internal Security Controls. Instead, it enhances visibility across External and Public-facing Environments.
For a deeper look at Outside-in Discovery, types of External Assets, and EASM use cases, these topics can be explored further in a dedicated article: What Is External Attack Surface Management (EASM)?
How Does ASM Benefit SOC and Security Teams?
For SOC and Security Teams, one of the most important benefits of ASM is improved Visibility and Context.
When teams have clearer information about what an Asset is, where it is located, who owns it, how it is exposed, and how important it is to the business, they can reduce the time spent gathering information before beginning investigation or remediation.
ASM also makes it easier for Security Teams to collaborate with IT, Cloud, Network, and Application Teams. Identified Exposures can be prioritized, assigned to the appropriate Asset Owners, and tracked through the Remediation process in a more systematic manner.
For organizations that already have an established Security Ecosystem, integrating Attack Surface information with Vulnerability Management, SIEM, SOAR, or IT Service Management (ITSM) can also help incorporate findings into existing Security Workflows instead of creating another standalone Dashboard for teams to monitor.
How to Choose an Attack Surface Management (ASM) Solution
When selecting an ASM solution, organizations should consider more than simply the number of Assets or Findings that the solution can discover.
The more important question is how effectively those findings can be used to reduce actual security risks.
Key areas to consider include:
- Asset Discovery Coverage – How well does the solution cover the Assets and Environments the organization needs to manage?
- Asset Attribution – How accurately can the solution determine whether a discovered Asset actually belongs to or is associated with the organization?
- Discovery Frequency – How quickly can the solution detect new Assets or Exposures?
- Risk Context & Prioritization – Can the solution distinguish Critical Exposures from Noise and help teams prioritize effectively?
- Unknown Asset & Shadow IT Visibility – How effectively can it identify Assets outside the existing Inventory?
- Remediation Workflow – Does it provide sufficient Context and Workflow capabilities to help teams resolve issues?
- Integration – Can it integrate with existing Vulnerability Management, SIEM, SOAR, ITSM, or other Security Tools?
- Reporting & Ownership – Can teams assign ownership and track the status of Exposures?
- Scalability – Can the solution support Multi-cloud environments, subsidiaries, and large-scale infrastructure?
Organizations should also test solutions within their actual Environment through a Proof of Concept (PoC) to evaluate Coverage, Accuracy, False Positives, Asset Attribution, and how easily Findings can be turned into actionable Remediation.
Improve Visibility, Reduce Blind Spots, and Strengthen Cybersecurity Risk Management with BMSP
Comprehensive visibility into an organization’s Attack Surface is an important foundation for effective Cybersecurity risk management, particularly when it comes to External Assets that may be exposed to the Internet without the organization being aware of them.
These unknown or unmanaged Assets can potentially become entry points that attackers exploit.
BMSP provides Cybersecurity consulting and solutions designed to help organizations improve Visibility, reduce Blind Spots that may lead to security risks, and strengthen their overall Cybersecurity Posture based on their specific Environment and business requirements.
If your organization is looking for Cybersecurity solutions, contact BMSP to speak with our team and find the right solutions for your business.
