{"id":17411,"date":"2019-10-01T15:03:07","date_gmt":"2019-10-01T19:03:07","guid":{"rendered":"https:\/\/www.elteni.com\/?p=17411"},"modified":"2019-10-01T15:03:07","modified_gmt":"2019-10-01T19:03:07","slug":"national-cybersecurity-awareness-month-know-your-attack-surface","status":"publish","type":"post","link":"https:\/\/www.elteni.com\/insights\/?p=17411","title":{"rendered":"National Cybersecurity Awareness Month – Know your Attack Surface"},"content":{"rendered":"

October is National Cybersecurity Awareness Month. Our goal this month is to provide you meaningful information to help you make well-informed, conscious decisions about how you should be protecting yourself and company from cyber threats.<\/p>\n

To start this month off we felt it was important for everyone to become familiar with the term \u201cattack surface\u201d. Your attack surface is all the information and vulnerabilities that can be found and used in a cyber-attack.<\/p>\n

Generally, the attack surface has been attributed to software and hardware that are publicly accessible by attackers. For example, at home it would be your internet router, or smart devices, and at the office it would be firewalls, remote access, webservers, video-conferencing equipment, etc.<\/p>\n

Too often do we forget that the true attack surface goes well beyond the software and hardware devices that exist on the network. Cyber threat actors use all of the other information available to them to create their attacks. What type of information? Glad you asked.<\/p>\n

    \n
  1. Social media information \u2013 Job, title, names, pets, family, birthdays, employees, locations, times, colleges, awards, vendors, etc.<\/li>\n
  2. Breached information \u2013 email addresses, passwords, phone numbers, names, addresses, etc.<\/li>\n
  3. Job Postings \u2013 hiring manager, technology you use, people that do not exist in your firm, accepted document types, etc.<\/li>\n
  4. Internet \u2013 IP addresses, DNS, website, hosted document metadata, clients, business partners, network devices, forums, blogs, GitHub, cloud storage, public records, wireless access points, etc.<\/li>\n
  5. Physical \u2013 recycled documents, weak entry points, tailgating, RFID-cloning, no-security, shoulder-surfing.<\/li>\n<\/ol>\n

    These are just some of the examples used by attackers when evaluating you or your company\u2019s attack surface. How can you create your own attack surface? For starters trying to develop a list based on the information found above. You can use the following to help with some of this.<\/p>\n

      \n
    1. Use advanced google search operators such as \u201callintext\u201d, \u201cinurl\u201d, \u201cfiletype\u201d\n