The external attack surface, organisations’ blind spot

What attackers see, and organisations do not

Firewalls, antivirus and SOCs protect what is inside the network. But before attacking, a cybercriminal looks at what is visible from the outside: websites, internet-facing servers, domain names, social media accounts and information published by staff.

Together, these form the external attack surface. It grows with every new online service, connected supplier and mobile app. And it is rarely monitored continuously.

Three threats taking shape outside your walls

1. Fake domains and phishing sites. A domain name one letter away from yours is enough to create a copy of your website or customer portal. Customers enter their credentials there, believing they are dealing with you. For a bank or operator, the damage is both financial and reputational.

2. Credential leaks. Staff passwords stolen from another site, databases resold on forums, VPN access offered by brokers: this information circulates on the deep and dark web, often long before an intrusion is detected.

3. Fake accounts and brand impersonation. Fake profiles of the CEO on social media, fake recruitment pages, fake apps in the organisation’s name: they are used to deceive customers, partners or staff.

On top of these come weaknesses in exposed assets: forgotten servers, expired certificates, misconfigured services, all easy entry points for an attacker.

Taking back control: monitor, detect, neutralise

Protecting the external attack surface relies on three actions:

• Continuously inventory all internet-facing assets, including those the organisation has forgotten.
• Monitor the surface, deep and dark web for threats targeting the organisation, its brands and its executives.
• Act fast: request the takedown of a fake site or account before it claims victims.

CTM360, a platform dedicated to external threats

CTM360 is a SaaS platform that brings together external attack surface management, digital risk protection and threat intelligence in a single tool. It relies on two main building blocks:

• HackerView, for the external attack surface. It automatically discovers the organisation’s digital assets, identifies their vulnerabilities, misconfigurations and exposures, and produces a risk score. Mapping is passive, with no installation and no impact on systems. The same tool can track the attack surface of suppliers and partners, and therefore third-party risk.
• CyberBlindspot, for digital risk protection. It monitors the surface, deep and dark web and covers more than 40 types of threats targeting the organisation, its brands and its executives. It also includes takedown services for fraudulent content, backed by a global network of ties with registrars and hosting providers.

CTM360 is recognised by industry analysts: Forrester listed it in 2018 among the top 14 digital risk protection companies worldwide, and Gartner mentioned it in 2021 as a digital risk protection and external attack surface management vendor.

Who is it for?

This approach is a priority for:

• banks and financial institutions, prime targets for phishing and brand impersonation;
• telecom and mobile money operators;
• public administrations and institutions, whose websites and leaders are regularly imitated;
• large companies exposed to CEO fraud and fake recruitment.

The GSS approach

GSS helps Chadian organisations set up this monitoring:

• initial assessment of the external attack surface;
• deployment and configuration of the CTM360 platform;
• alert analysis and follow-up of takedown requests;
• integration with the organisation’s SOC, where one exists.

Conclusion

You can only protect what you can see. Monitoring your external attack surface means looking at your organisation through the attacker’s eyes, and acting before they do.

Want to know what an attacker sees of your organisation? GSS experts offer an initial assessment of your external attack surface. Contact us.