N100FN100F
Published on

What an attacker sees

You cannot protect what you do not know exists. The attack surface is everything somebody outside can reach: addresses, ports, domains, forgotten services. Inventorying it is the first control.

Service line Cybersecurity

What nobody remembers publishing

Almost every breach starts with something the organisation did not know was exposed: a test environment with a public address, a subdomain pointing at a decommissioned service, an administration panel left open 'temporarily', a database reachable from the internet through a misconfiguration.

Nobody protected them because nobody had them on the list. For an attacker, by contrast, they are the first thing that shows up.

What an attacker sees47 exposed items, 16 outside the inventory, with their risk and their action.SECURITY · SURFACEWhat an attacker sees47 ITEMS EXPOSED TO THE INTERNET31 in the inventory16 outside itAMONG THOSE NOBODY HAD ON THE LISTTest environment with a public addressDoes it have to be exposed? No: private accesshigh'Temporary' administration panelClose it and use per-application accesshighTwo subdomains pointing at retired servicesDelete the recordsmediumDatabase with a port left open by mistakeClose today and review accesscriticalReduce first: whatever does not have to be exposed gets closed.Whatever does goes through the exposed zone with its protection.Illustrative data; they do not correspond to any real caseN100F · n100f.com

Looking from outside

The surface inventory is done from the attacker's point of view, not from the documentation:

  • Public addresses assigned in each cloud and on your own infrastructure.
  • Domains and subdomains, including those pointing at services that no longer exist.
  • Ports and services answering from the internet.
  • Certificates issued for the organisation's names, which reveal systems nobody sometimes remembers.
  • Leaked credentials in public repositories or known dumps.

What is found is compared with what you believe is exposed. The difference is the most urgent work list there is (just as in the survey of what you inherited, but looking outwards).

Reduce before protecting

For each exposed item, the first question is not 'how do I protect it?', but 'does it have to be exposed?'. Often the answer is no:

  • Test environments and administration panels are not published; they are reached through private access.
  • Orphaned subdomains are deleted.
  • What does have to be public goes through the exposed zone, with its protection, as in designing by zones.

An inventory that does not age

The surface changes every time somebody deploys something. That is why the inventory is not an annual exercise, but a periodic, automatic check that raises an alert when something newly exposed appears that was not planned.

Knowing what has to be protected enables the next step: deciding with which controls, and building on what already exists instead of inventing it.

How we apply it: Cybersecurity.

If your cloud cost keeps growing and nobody knows why, or your architecture depends on whoever built it, let’s talk.

Let’s talk