Attack surface management overview

Comprehensive inventory of Internet-facing assets to eliminate asset blind spots

• Business challenge: Rapid business growth leaves behind numerous test and development remnants, subsidiary resources, or unmanaged cloud assets, making it impossible to fully understand the exposure risks.

• Solution: Use the Asset discovery feature of attack surface management. The system uses WAF, Cloud Firewall, domain names, certificates, and EIPs as anchor points to automatically and continuously perform association analysis, discovering known Cloud Assets and unknown Shadow Assets.

• Core value: Bring scattered, unknown assets into a unified security view, providing a complete and accurate asset inventory for subsequent risk reduction.

Simulate the attacker's perspective to identify and block critical attack paths

• Business challenge: The large number of assets and vulnerabilities makes it difficult to determine which risk combinations pose the greatest threat and should be prioritized for remediation.

• Solution: Attack surface management analyzes network reachability, vulnerabilities, and risky configurations between assets to automatically deduce potential attack paths, and presents the complete chain from start asset to end asset in a topology graph.

• Core value: Examine security defense from an attacker's perspective, focusing on remediating high-value risk points (such as critical nodes) that can block key attack paths, achieving precise and efficient risk handling.

Continuously monitor and reduce the attack surface

• Business challenge: New service launches or configuration changes may introduce new exposure surfaces. How can you ensure that the attack surface is not inadvertently expanded?

• Solution: Through periodic asset scanning and risk assessment, continuously monitor attack surface changes. Centrally manage the asset inventory and confirm the ownership status of shadow assets to ensure the accuracy of the attack surface view.

• Core value: Transform one-time security assessments into a normalized risk governance process, dynamically adapting to business changes and continuously reducing exposure risks.

Border Asset Discovery

Asset discovery builds a complete closed loop from asset inventory, association analysis, to risk identification and remediation recommendations through multi-dimensional cloud product integration and automated mapping technology. This feature is designed to help enterprises clarify asset baselines, identify unmanaged "shadow assets," and reduce Internet-facing exposure from an attacker's perspective.

• Automated asset mapping

  The system deeply integrates multiple cloud product APIs to automatically sync and aggregate cloud assets and their associated Internet fingerprint information, establishing precise service-to-resource mappings.

  • Multi-dimensional asset detection: Based on cloud products such as WAF, Cloud Firewall, ECS, SLB, EIP, and containers, combined with domain name, IP, and SSL certificate information, discover ports and web fingerprints through association analysis.

    • Web Application Firewall (WAF) and Cloud Firewall (CFW): Obtain protected domain names and public IP addresses.

    • Domain names (Alibaba Cloud HiChina): Sync registered domain names under your account.

    • Certificates (SSL): Parse certificates and extract strongly associated domain names and subdomains.

    • Elastic IP (EIP): Obtain the complete EIP list under your account, forming a baseline inventory of public IP assets.

    • Elastic Compute Service (ECS): Sync ECS instances and their associated public IP addresses.

    • Server Load Balancer (SLB): Extract SLB listener configurations (such as certificates) and backend server groups (ECS instances), establishing service-to-resource mappings.

  • Shadow asset identification: Leverage existing asset information to further discover unmanaged "shadow assets," building a complete baseline inventory of public IP addresses and domain names.

• Asset ownership management

  Supports status classification and granular management of three core asset types: domain names, IP addresses, and certificates, ensuring the accuracy and compliance of scanning resources.

  Important

  The system only performs vulnerability scanning and attack path analysis on Attributed assets, and uses them as new scanning starting points to discover more associated shadow assets.

  • Attributed: Assets confirmed as belonging to the current account.

  • Unconfirmed: Shadow assets discovered by scanning but not yet ownership-confirmed, pending processing.

  • To Be Investigated: Asset ownership is under investigation, and the status is temporarily unclear.

  • Ignored: Assets confirmed as non-corporate assets, or assets that do not need to be included in the scanning scope.

• Automated scanning and task management

  Provides flexible scanning strategies to meet security detection needs in different scenarios.

  • Scan types:

    • One-click scan: Triggered on demand, suitable for emergency response or comprehensive inventory before new service launches.

    • Periodic scan: Supports on-demand configuration (such as weekly/monthly) for ongoing monitoring of asset exposure.

  • Task management: After a scan task is configured, it will sequentially execute Refresh Cloud Assets, Cloud Product Exposure Analysis Task, and Attack Path Analysis. Use the task management module to view the overall scan progress and sub-task execution details and status in real time.

Attack Risk

• Attack risk analysis

  Based on asset associations and vulnerability intelligence, simulate and deduce potential intrusion chains.

  • Attack path deduction: Combining network reachability, system vulnerabilities, weak passwords, cloud security posture (CSPM), and sensitive asset information, logically deduce the complete attack sequence from an Internet entry point (start asset) to a core target (end asset).

  • Visual graph: Provides Attack Path, graphically displaying attack nodes, lateral movement paths, and associated exposed components, intuitively presenting risk propagation relationships in complex network environments.

  • Multi-dimensional risk tags: Covering alerts, vulnerabilities, weak passwords, critical nodes, sensitive assets, exposed AI applications, and cloud security configuration risks, helping precisely locate high-risk points.

  • Posture overview: Quantify the overall attack surface risk posture through Top 5 risk paths, attack path type distribution, and asset exposure method statistics.

• Risk handling

  • Remediation and hardening

    For specific risk points revealed by attack path nodes in the Attack Path (such as system vulnerabilities, CSPM configuration risks, network port exposure), go to the corresponding vulnerability management, CSPM module, or ECS console for remediation, hardening, and security group rule adjustments to eliminate risks at the source.

  • Handle (allowlist)

    Applicable for confirmed false positives or acceptable risks. By configuring an allowlist policy, exclude the attack path from a specific start asset to an end asset. The system will no longer generate risk data for that path.

  • AI Analysis: When the attack path is complex, use the security AI assistant to perform automated comprehensive analysis on the current path or asset, obtaining detailed remediation suggestions from cause determination, impact assessment to specific operational procedures, assisting in formulating a handling plan.