Attack Surface Area Larger Than Most Businesses Believe

guest · Jun 11, 2020

Attack Surface Area Larger Than Most Businesses Believe
June 11, 2020
https://www.darkreading.com/perimet...r-than-most-businesses-believe/d/d-id/1338057

Companies focused on employees' systems and cloud infrastructure are not capturing the true extent of their attack surface area, which includes phishing domains using a business's brand, counterfeit mobile apps, and vulnerable web frameworks and plugins, according to a survey of such vulnerabilities published on Thursday.

In its "Analysis of an Attack Surface" report, security firm RiskIQ found a quarter of the top 10,000 Alexa domains had servers running at least one vulnerable web component and that the largest companies typically had more than 300 expired certificates, more than 700 potential development testing sites accessible from the Internet, and 80 instances of web applications running on soon-to-be-outdated versions of PHP.
Click to expand...

The sheer variety of potentially vulnerable components underscores that companies often do not know about all the assets — and potentially vulnerable applications — that they have exposed to the Internet, says Steve Ginty, director of threat intelligence for RiskIQ.

"It comes back to the basics in terms of visibility and management — you can't defend something if you don't know it exists," he says. "Web infrastructure gets forgotten. Employees stand up shadow IT. It really comes down to visibility."
Click to expand...

RiskIQ: Analysis of an Attack Surface

Five Ways Hackers are Targeting Organizations

The Global Attack Surface is much bigger than you think: How big is the internet, and how quickly is it growing? RiskIQ telemetry tells the story.

Sometimes hackers know more about your attack surface than you do: The attack surfaces of FTSE-30 companies show that even the average large-cap organization has visibility issues leading to vulnerabilities across its digital presence.

The hidden attack surface: Attackers don’t have to breach an asset you own to attack you. Rogue threats mimicking brands to attack their employees and customers prevail internet-wide.

The mobile attack surface: Organizations shouldn’t just focus on the Apple App Store and Google Play when defending their mobile presence. RiskIQ data explores the threat landscape across 120 mobile app stores and the open internet.

JavaScript Threats – A New Frontier of Cybercrime: Organizations are finding that the code on their website is a fertile ground for cybercrime. RiskIQ detection data shows how JavaScript threats like Magecart are becoming more frequent.

Click to expand...

Log in or Sign up

Attack Surface Area Larger Than Most Businesses Believe

guest Guest

Log in or Sign up

Attack Surface Area Larger Than Most Businesses Believe

guest Guest

Useful Searches