How to assess your threat surface

As remote and hybrid work continue to be common among organizations, employees depend on numerous cloud-based apps and tools to do their jobs from just about anywhere. There are many advantages to this flexible work arrangement, but it has drastically expanded the typical cyber threat surface.

In other words, there are more attack opportunities today for threat actors to narrow in on. And of course, more opportunities for them = more risk for you.

But by understanding, managing, and reducing your company's cyber threat surface, effectively lowering the number of ways a threat actor can gain access, it becomes much easier to defend against future cyberattacks. 

But how do you do it? It starts with learning exactly what a cyber threat surface is.

What is a cyber threat surface?

Your company’s cyber threat surface includes all areas of your IT network where unauthorized users or attackers could exploit vulnerabilities to gain access to systems and confidential data to stage an attack. This is also sometimes called an attack surface.

Taking active steps to manage and reduce your threat surface can reduce the likelihood of a successful cyberattack on your organization. 

However, doing this is easier said than done.

For one, understanding and managing your threat surface takes time that not all businesses will have. Also, new technology, users, and connections can be introduced almost daily, further expanding your threat surface and increasing the number of attackable points and overall risk.

Let’s explore what constitutes a threat surface, how attackers exploit vulnerabilities, and easy steps you can take to reduce your cyber risk.

Understanding your threat surface

A cyber threat surface can include any number of components, and that makes mapping and visualizing them all challenging.

Think of it this way: a brick-and-mortar store or office also has a threat surface. In this case, it’s every point of entry and every potential vulnerability in the building. A criminal could smash the front window, break down a door, or use a side window. Or, maybe they're a bit bolder and try to rob the place by coming in during business hours. Safes, cash boxes, inventory, company vehicles, and more could all be considered part of a company’s threat surface.

With this idea in mind, it becomes easier to visualize a cyber threat surface—that is, your organization's hardware, software, data, people, and devices.

But we can break things down even further for added clarity. The cyber threat surface has two major components: the digital and physical attack surfaces.

Download the eBook and learn how to choose the right cybersecurity solution.

Download now

Digital attack surfaces

As the name suggests, your digital attack surface covers all things software or data-related. These are the intangible aspects of the threat surface, those pieces of IT you own or use that don’t have a physical footprint. A digital attack surface may include:

• Applications
• Servers
• Websites
• Ports
• Shadow IT (technology and tools not under direct control of your IT department)

Vulnerabilities in any of the above could make it easier for attackers to access your confidential data, allowing them to inject malicious code to obtain sensitive information, for example, or encrypt it and hold it for ransom.

Physical attack surfaces

The physical attack surface refers to the tangible devices and technology that connect to a network—everything from a computer to a router or even a tiny flash drive. These are real objects that could be compromised through physical presence. Think of things you can hold or touch, such as: 

• Desktops
• Laptops
• Smartphones
• USB drives
• Hard drives

If attackers gain access to a physical device, they can explore the systems and networks it connects with, letting them stage further attacks.

When you look at it through this lens, cyber threat surfaces start to seem like a lot of things you need to cover. If you think of it in terms of digital and physical components, even the smallest business’ threat surface can feel overwhelming. This is becoming more pronounced as the cybersecurity industry continues its lightning-fast evolution.

How are cyber threat surfaces changing?

That lightning-fast evolution is nothing new. If you’ve spent time exploring anything related to cybersecurity, you’re well aware that it’s constantly changing.

New threats, defenses, and technology are always in play, and attackers and defenders are always trying to get a leg up on each other. Equal parts cat-and-mouse game and arms race, cybersecurity is a dynamic subject that continues to grow in importance.

Experts are also starting to place more emphasis on a third threat surface: humans. Unintentional and deliberate actions from within your company can be a major cause of cyberattacks and add significant risk to your business—especially with remote and hybrid work so prevalent.

Employees continue to choose remote work over in-office work, which can increase risk. Yet, in-office or out, each employee expands the threat surface. Even with a secure internet connection and the right toolset, a single click (accidentally or otherwise) can easily undo all the work that goes into keeping a company protected.

To secure increasingly remote workforces, businesses are adding new solutions to their technology stacks. Whether to close gaps, eliminate vulnerabilities, or monitor their network, it’s not uncommon for companies to use a significant number of tools to get the job done. Even these can add to your threat surface though, especially if configured incorrectly or left out of date.

All of this is to say that IT networks and systems are becoming more complex. This complexity makes it harder to spot attacks early and take appropriate action to mitigate cyber threats.

Cybersecurity threats and risks

Part of reducing and managing your threat surface is knowing what needs protecting. Another key part is knowing the wide range of potential cyberattacks that pose a risk to your threat surface.

These attacks include:

• Ransomware
• Phishing
• Compromised credentials
• Brute force attacks
• Zero-days
• Unnecessary or exposed code
• Misconfigured tech
• Insider threats

We explore each of these below.

Ransomware

Ransomware attacks use strains of malicious software (malware) designed to block access to your computer or data, encrypting it or locking it up and demanding payment to restore access.

Ransomware attacks frequently rely on phishing or brute force techniques to gain initial access to systems and then exploit vulnerabilities to infect systems further and install ransomware.

Phishing

Phishing attacks leverage social engineering techniques to appear as legitimate requests, luring users into taking action that would compromise their accounts.

Phishing is frequently used to compromise and harvest credentials but may also be used for online fraud or to conduct further malware attacks.

Compromised credentials

Often, a weak password or one reused across multiple accounts can provide cybercriminals with the access they need to stage an attack.

Successful phishing attacks can also provide attackers with the credentials they need to access IT systems. Any repeated instances of that password are thus also compromised.

Brute force attacks

As the name suggests, brute force attacks attempt to forcibly gain access by using predetermined values to make repeated requests to a server and analyzing the responses.

Think of a numeric keypad used to unlock a four-digit code; using a program or tool, an attacker would automate testing every possible code variation to find the right combination and gain access.

Zero-days

Zero-day attacks occur when a cyber criminal exploits a vulnerability before the software vendor or developer can patch it. These vulnerabilities are often unknown until the day of the attack, hence the name.

Unnecessary or exposed code

All code has the potential to contain flaws, and extraneous or unnecessary code left in a program could give attackers a potential vector for accessing confidential data. Reducing the amount of code used in your IT network and software can help reduce your threat surface.

Misconfigured tech

Settings and configurations that cause unintended behavior on an IT system could threaten your security. For example, incorrectly configured remote desktop protocols (RDPs) can expose your business to significant threats like ransomware.

Insider threats

Threats can also come from within an organization or network. Employees deliberately or accidentally providing unauthorized users access is another risk facing any business.

Misconceptions about the threat surface

Because threat surfaces are hard to visualize and understand, and also because they're ever-changing, there are some common misconceptions that just won't seem to go away. Let's debunk some of those myths to set you up for better success.

“New software and technology will solve security issues.”

This is a bit of a double-edged sword. While adding software and technology can help businesses manage their cybersecurity needs, simply adding software and programs will not reduce the attack surface.

If anything, additional software expands it because it represents another attackable point for criminals to exploit. New tools and technology also introduce additional alerts and warnings, which can lead to alert fatigue and result in missing critical issues and threats.

“If it’s in the cloud, it’s secure.”

Cloud-based services and software are as attackable as any other part of an IT environment. The cloud is not untouchable. 

What’s more, many cloud services operate on a shared responsibility model. This means that while cloud service providers will try to secure their assets, they are not necessarily responsible for securing the connection to your assets.

“It's possible to be 100% secure.”

Achieving 100% protection from cybersecurity risks is, unfortunately, unrealistic. The computers and software companies use today are incredibly complex. Even simple tasks can produce millions of interactions between technological components, making it difficult to detect every single suspicious action. 

Besides, threat actors have become increasingly sophisticated. One group of threat actors recently used malicious code to infect a legitimate software update from a widely used enterprise program. The attackers did so by signing the malware with an actual Microsoft security certification, making it even more challenging for traditional software to detect.

Similarly, as phishing attacks become more targeted and appear more legitimate, even well-trained cybersecurity pros can accidentally click a malicious link.

The point isn’t that your company is destined for cybersecurity doom. What is important is that you consider the fact that, despite your best efforts, a breach could still happen. Even more important is that you remember great cybersecurity is holistic. Reduce risk as much as possible but, also, have the measures in place to detect, respond, and recover from an incident effectively. 

Threat surface management

Assessing and managing your threat surface while reducing the number of attackable points requires knowledge and experience. Building both takes time. After all, to stop a threat, you need to know what you’re securing, which requires understanding your IT network and systems and the impacts an attack would have on them.

Cyber situational awareness (CSA) can help your business better focus on the threats most likely to affect your IT environment. CSA can best be defined as:

• Knowing your network
• Knowing your threats
• Knowing how to respond to these threats

Building your organization’s CSA can help you map out every component of your IT network, a process you’ll need to do as part of any threat surface management and assessment initiative your business undertakes. What’s more, CSA can also help you take a proactive, big-picture look at your cybersecurity needs.

Take some time to do this and consider an attacker’s perspective. Where might they try and gain access? Are there any particularly obvious attack vectors or vulnerabilities that you’re already aware of?

Generally speaking, there are three components of this assessment.

1. Conduct an inventory of your IT assets

Which IT assets does your business use, and how might they be of value to others? This can include hardware, software, internet-facing assets, personal data, sensitive information, intellectual information, and even your supply chain.

2. Measure cyber risk

What would be the worst-case scenario if your assets were compromised? How vulnerable to attack are these assets?

Assess the risks your assets may introduce and evaluate the protections you have in place. This will help you establish a security baseline to measure against as you resolve risks and improve your security.

3. Improve security posture

Once you’ve assessed your IT assets and determined their risks, you can use this information to make strategic decisions about your security posture:

• What protections do you have in place now?
• Are they sufficient or do you need more resources?
• Who is responsible for protecting your assets?

This approach can help your company pinpoint the threats most relevant to your business and make decisions accordingly. Repeating the process regularly as you add or remove potential attack vectors and continue strengthening your defenses is essential.

Need help with your threat surface?

As cybersecurity attack vectors evolve and threat surfaces grow, it’s more important than ever to take a proactive approach to defending your business. But it's not something you have to do in-house, or manually. 

Certain cybersecurity solutions can help proactively reduce your threat surface by identifying risky vulnerabilities across your entire threat surface, including things like unpatched software or application misconfigurations.

To learn more about finding a cybersecurity solution that can do all that and more, download our free eBook today, Choosing a Cybersecurity Solution: Your Guide to Getting it Right.