Anatomy of an external attack surface

Most cyberattacks originate miles away from the network; web applications comprised the vector category most commonly exploited in hacking-related breaches. Unfortunately, most organizations lack a complete view of their internet assets and how those assets connect to the global attack surface. Three significant contributors to this lack of visibility are shadow IT, mergers and acquisitions (M&A), and digital supply chains.

Shadow IT

Where IT can’t keep pace with business requirements, the business looks elsewhere for support in developing and deploying new web assets. The security team is frequently in the dark regarding these shadow IT activities and, as a result, cannot bring the created assets within the scope of their security program. Unmanaged and orphaned assets can become a liability in an organization’s attack surface over time.

This rapid proliferation of digital assets outside the firewall is now the norm. New RiskIQ customers typically find approximately 30 percent more assets than they thought they had, and RiskIQ detects 15 expired services (susceptible to subdomain takeover) and 143 open ports every minute.²

Mergers and acquisitions

Everyday operations and critical business initiatives such as M&A, strategic partnerships, and outsourcing create and expand external attack surfaces. Today, less than 10 percent of deals globally contain cybersecurity due diligence.

There are several common reasons why organizations are not getting a complete view of potential cyber risks during the due diligence process. The first is the sheer scale of the company’s digital presence they’re acquiring. It’s not uncommon for a large organization to have thousands—or even tens of thousands—of active websites and other publicly exposed assets. While IT and security teams in the to-be-acquired company will have an asset register of websites, it’s almost always only a partial view of what exists. The more decentralized an organization’s IT activities are, the more significant the gap.

Supply chains

The enterprise is increasingly dependent upon the digital alliances that form the modern supply chain. While these dependencies are essential to operating in the 21st century, they also create a cluttered, layered, and highly complicated web of third-party relationships, many of which are outside the purview of security and risk teams to protect and defend proactively. As a result, quickly identifying vulnerable digital assets that signal risk is a massive challenge.

A lack of understanding and visibility into these dependencies have made third-party attacks one of the most frequent and effective vectors for threat actors. A significant amount of attacks now come through the digital supply chain. Today, 70 percent of IT professionals indicated a moderate-to-high level of dependency on external entities that might include third, fourth, or fifth parties.⁹ At the same time, 53 percent of organizations have experienced at least one data breach caused by a third party.¹⁰

While large-scale supply chain attacks become more common, organizations deal with smaller ones daily. Digital credit card skimming malware like Magecart affects third-party e-commerce plugins. In February 2022, RiskIQ detected more than 300 domains affected by Magecart digital credit card-skimming malware.¹¹

Today’s global internet attack surface has transformed dramatically into a dynamic, all-encompassing, and completely entwined ecosystem that we’re all a part of. If you have an internet presence, you interconnect with everyone else, including those that want to do you harm. For this reason, tracking threat infrastructure is just as important as tracking your own infrastructure.

Different threat groups will recycle and share infrastructure—IPs, domains, and certificates—and use open-source commodity tools, such as malware, phish kits, and C2 components to avoid easy attribution, tweaking and improving them to fit their unique needs.

More than 560,000 new pieces of malware are detected every day, and the number of phishing kits advertised on underground cybercrime marketplaces doubled between 2018 and 2019. In 2020, the number of detected malware variants rose by 74 percent.¹⁴ RiskIQ now detects a Cobalt Strike C2 server every 49 minutes.