An organisation’s external attack surface is everything visible from the Internet: domains, subdomains, reachable services, certificates, open ports. It grows with websites, online tools and providers, often without the IT team knowing.
What external attack surface management is
External attack surface management (EASM) consists of listing these elements from the outside, the way anyone on the Internet would see them, then ranking them and fixing what needs fixing.
It differs from an internal vulnerability scan. An internal scan starts from the inventory you already have. An outside view finds what was never written down in an inventory.
What it sees, and what it does not
It sees what is public: domain names published in DNS, certificates published, services that answer on the Internet.
It does not see what is internal, or what is reachable only with an account. It therefore does not replace an asset inventory or a review of access rights. It complements them.
First steps
- List the known domains. Main domains, service sites, and the domains of providers that host something in your name.
- Look for what is not listed. Browse public subdomains and the certificates issued for your names. A forgotten test subdomain often turns up this way.
- Check ownership. Only analyse domains you are responsible for, or for which you have written authorisation.
- Set priorities. An exposed administration service comes before an up-to-date showcase page.
- Fix, then monitor. Close what needs closing, then repeat the discovery at regular intervals, because the surface changes.
Where our tool stands
Atlas is Range Zero’s first product. It automates the discovery described above. It is in development and not yet open to the public. You can request alpha access.