Industry Insights

How to Protect and Reduce Your Attack Surface at the Edge

By Brad LaPorte

September 12, 2024

Understanding the cyber attack surface

Historically, the “attack surface” was limited to well-known points of external exposure—the traditional perimeter of websites, external IP addresses, and endpoints. Our cyber attack surface has expanded dramatically over the past five years, now encompassing our cloud estate, millions of devices at the edge, and mobile and remote workers, in addition to our internet-facing infrastructure.

This expansion of the definition to include cloud, end-user, and internal assets has been driven by the increasing sophistication of cyber attacks. The table below breaks down today’s complex attack surface into several categories, based on a framework presented by Steve Santos of Gartner at a conference in June 2024:

As Figure 1 shows, the attack surface today is the sum of all possible points where an unauthorized user can try to enter data into or extract data from an environment, and it includes hardware, software, and network components.

Reduction vs Protection

Reduction and protection of the attack surface are separate but obviously interlinked strategies for improving security overall. Reducing the attack surface means eliminating points of potential exposure or walling off access to them, which requires a thorough grasp of those points of vulnerability. There are always concrete opportunities for such reduction, but this approach quickly runs up against the reality of today’s integrated and distributed work and networks. Better protection begins with improved visibility and runs to hardening all the identified points of vulnerability against unauthorized access and malicious code.

The table highlights the complexity and diversity of today’s cyber attack surface, illustrating how it extends beyond traditional boundaries. This expanded landscape signifies that organizations must adopt a more comprehensive approach to security, considering not just external threats but also internal vulnerabilities. By understanding these components, businesses can prioritize their security strategies, focusing on both reducing exposure and enhancing protection. This sets the stage for exploring effective methods to safeguard your assets in the next section.

Top 9 actions to reduce and protect your cyber attack surface

Reducing and robustly protecting your cyber attack surface requires a strategic approach and the right tools. Below are the top nine actions you can take, with the relevant attack surfaces noted for each item:

1. Reduce points of exposure

(Attack surfaces: External, Internal, End-user)

Streamlining and securing points of exposure is crucial in minimizing vulnerabilities. By encrypting communications, organizations can significantly reduce their attack surface, ensuring that data is safeguarded both during transmission and when stored.

• Regular vulnerability assessments: Conduct regular vulnerability assessments and penetration testing to identify and address security weaknesses and re-evaluate to what degree and to whom certain networks and resources need to be exposed.
• Micro-segmentation: Divide your network into smaller segments to effectively isolate all parts of the network and limit the lateral movement of threats.
• Encrypt data in transit: Ensure all data transmitted between remote users and corporate resources is encrypted end-to-end, from the source to the destination, even within on-premises environments.
• Encrypt data at rest: Ensure that data stored on devices and servers is encrypted.
• Log all communications: Maintain logs of all communications for auditing and forensic purposes.
• Patch management: Ensure that all software and hardware components are up to date with the latest security patches.
• Integrate networking and security: Among other benefits, implementing a SASE solution that combines networking and security on a single platform serves to reduce the attack surface by eliminating multiple points of integration and access.

2. Enhance visibility

(Attack surfaces: Cloud, Internal, End-user)

Ensuring comprehensive visibility into your network, devices, and user activities is crucial for proactively reducing the attack surface. By identifying and addressing vulnerabilities and threats in real-time, visibility allows you to understand and minimize potential entry points for attackers. Without it, you remain unaware of existing weaknesses, leaving your system exposed. A short checklist to enhance visibility includes:

• Network traffic monitoring: Continuously monitor all network traffic for unusual patterns to detect potential threats early.
• Device and endpoint inventory: Maintain an up-to-date inventory of all connected devices to ensure no unknown endpoints are vulnerable.
• User activity monitoring: Track user activities across applications and systems to identify suspicious behavior.
• Application visibility: Gain insights into how applications are used within your network to uncover potential risks.
• Log management and analysis: Collect and analyze logs from various sources to correlate events and spot anomalies.
• Security Information and Event Management (SIEM): * Aggregate and analyze security data to identify and respond to potential threats quickly.

3. Implement unified security policy management

(Attack surfaces: Cloud, Internal, End-user)

Unified security policy management is crucial for maintaining consistent security across all network segments and endpoints. It simplifies the enforcement of security policies, ensuring that all users, devices, and applications adhere to the same rules. Related key steps include:

• Centralize policy management: Use a single console to manage policies across your entire network, reducing the complexity and potential for misconfigurations.
• Automate policy enforcement: Automate the application of security policies to ensure they are consistently enforced, regardless of changes in the network environment.
• Monitor and audit: Continuously monitor and audit your security policies to identify and rectify any deviations or weaknesses.

4. Adopt Zero Trust Network Access (ZTNA) with advanced capabilities

(Attack surfaces: External, Internal, End-user)

With the increase in remote and hybrid work, securing remote access is more important than ever. Zero Trust Network Access (ZTNA) solutions enforce strict identity verification and access controls for such users, but it’s equally important to implement Zero Trust controls for your internal LAN and data center networks as well to defend against lateral movement after your network is breached and ensure a consistent access experience for your users, whether they are inside or outside the corporate network. Advanced capabilities like Dynamic Access Control further enhance ZTNA by adjusting access permissions based on the current context and risk level. ZTNA is essential for both internal and remote users to prevent unauthorized access and minimize lateral movement within networks. By enforcing strict identity verification, ZTNA ensures that only authenticated users can access specific resources, regardless of their location. This approach limits a malicious user’s ability to exploit weak points by:

• Verify every access request: Implement multi-factor authentication (MFA) and continuous verification to ensure that access is granted only to legitimate users.
• Role-Based Access Controls: Assign access rights based on user roles, ensuring users can only access necessary resources.
• Least privilege access: Grant users the minimum level of access required for their tasks, reducing the risk of broad access.
• Dynamic Access Control: Adjust access permissions dynamically based on context, such as user location, device type, and behavior patterns, ensuring only authorized users can access sensitive resources.
• Adaptive authentication: Implement adaptive authentication mechanisms that require additional verification for high-risk access attempts and deter malicious users.
• Real-time monitoring: Continuously monitor access activity and adjust permissions in real-time to respond to emerging threats and prevent lateral movement.

5. Enhance legacy infrastructure with a software-defined network overlay

(Attack surfaces: Cloud, Internal, End-user)

Business locations today are varied, ranging from branch offices and campuses to remote production facilities that rely on a mix of broadband, cellular, and satellite connections. With the need to support cloud connectivity, remote users, and internet breakout, legacy infrastructure often leads to security gaps and management challenges. Steps for more robust protection at your locations include:

• Leverage SASE: Use Secure Access Service Edge (SASE) or Security Service Edge (SSE) to enforce security at the network edge, providing secure, direct access to cloud and on-premises applications.
• SD-LAN overlay: Implement a software-defined LAN overlay to enhance agility and security by integrating switching, routing, and security services. This setup allows centralized management and improves visibility across your network, reducing complexity and increasing efficiency.
• Robust endpoint security: Protect remote devices from threats by implementing comprehensive security measures, including regular updates, advanced threat detection tools, and strict access controls based on user roles and permissions.

6. Integrate threat prevention and detection

(Attack surfaces: Digital, External, Cloud, Internal, End-user)

Integrated threat prevention and detection involves using advanced security technologies that have been developed in a single, modern SASE or SSE platform to exploit synergies and monitor attack vectors, identify attacks, and mitigate threats in real time. Ideal platform security capabilities include:

• Next-Generation Firewall (NGFW): Get advanced threat protection, including intrusion prevention, application control, and URL filtering.
• Secure Web Gateway (SWG): Protect users from web-based threats by inspecting and filtering web traffic.
• Cloud Access Security Broker (CASB): Secure access to cloud services and monitor cloud activity for suspicious behavior.
• Zero Trust Network Access (ZTNA): Enforce strict identity verification and access controls, ensuring that no user or device is trusted by default.
• Data Loss Prevention (DLP): Use DLP technologies to monitor and protect sensitive data from unauthorized access, use, and transmission.
• IDS/IPS: Detect and block malicious activities automatically with Intrusion Detection and Prevention Systems
• Advanced Threat Protection: Leverage advanced threat protection mechanisms with threat intelligence and multi-sandboxing to identify and mitigate sophisticated cyber threats, including Zero-Days.

7. Extend Zero Trust to devices

(Attack surfaces: Internal, End-user)

“Device trust” ensures that only authorized devices gain network access. This involves verifying device identity and authentication, distinguishing between company-owned and BYOD (Bring Your Own Device), and applying access controls based on security criteria.

• Device authentication: Verify and authenticate all devices accessing the network.
• Authorization assessment: Check if devices are company-owned or BYOD and apply relevant policies.
• Access control: Ensure devices meet security standards before granting network access.

8. Device posture check

(Attack surfaces: External, Internal, End-user)

Evaluating the security posture of devices attempting to access the network includes baselining normal behavior and identifying anomalies that might indicate the device has been compromised, adaptive and conditional access controls, ensuring security compliance, identifying device vulnerabilities, and taking action based on these posture checks.

• Adaptive and conditional access: Implement access controls that adapt to the current context and risk level.
• Security compliance: Ensure that all devices comply with your organization’s security policies.
• Device vulnerabilities: Regularly scan for and address device vulnerabilities to prevent exploitation.

9. Extend Zero Trust to internal and external apps and workloads

(Attack surfaces: External, Cloud)

Application and workload access involves verifying access rights, ensuring specific access controls, and determining whether the applications or workloads are available to the internet. It is critical to secure internet-facing admin controls, APIs, and workloads comprehensively.

• Verify access rights: Ensure that only authorized users can access specific applications and workloads. This involves implementing robust authentication and authorization mechanisms to restrict access to sensitive resources.
• Specific access controls: Apply access controls tailored to individual applications and workloads. Different resources may have varying security requirements, so it is essential to customize access policies to meet these specific needs. For instance, stricter controls should be applied for applications and workloads handling sensitive data.
• Internet accessibility: Assess whether applications and workloads should be accessible from the internet and secure them accordingly. Public-facing resources should be fortified with additional security measures such as web application firewalls (WAFs) and regular security audits to prevent unauthorized access and attacks.
• Discovery and shadow IT mitigation: Implement discovery of applications and workloads to identify and manage Shadow IT. Shadow IT refers to the use of unauthorized applications or workloads within an organization. By discovering and cataloging all resources in use, you can enforce security policies and prevent potential vulnerabilities.
• Implement CASB: SaaS applications are hosted and maintained by third-party providers. To secure SaaS applications, leverage Cloud Access Security Brokers (CASB) to monitor and control access, enforce data protection policies, and ensure compliance with regulatory requirements. Implement Single Sign-On (SSO) and Multi-Factor Authentication (MFA) to enhance security and simplify user access.
• Private applications: Private applications are hosted within an organization’s own data centers or private clouds. Securing these applications involves implementing Zero Trust Network Access (ZTNA) principles, which ensure that no user or device is trusted by default.
• Securing workloads: Implement security measures at the workload level, such as runtime protection, vulnerability management, and compliance monitoring. Use container security solutions to safeguard containerized applications, ensuring they are free from vulnerabilities and misconfigurations.
• Continuous monitoring: Continuously monitor workloads for security threats and anomalies.

Mapping of actions to attack surfaces

Figure 2 below outlines how each action above addresses specific attack surface categories identified by Gartner.

Conclusion

Reducing and improving the protection of your cyber attack surface is a continuous process that requires a combination of strategic planning, advanced security technologies, and proactive management. By implementing device trust, adopting user identity verification, performing regular posture checks, securing application access, implementing encrypted communication, and embracing zero trust, you can significantly enhance your organization’s cybersecurity posture. Modern SASE and SSE platforms provide an opportunity to implement a holistic strategy for protecting your attack surface, rather than addressing each action area in isolation.

For more detailed guidance and practical steps, consider attending our upcoming webinar on “Top 9 Actions to Reduce and Protect Your Cyber Attack Surface.” We will provide checklists, templates, and actionable advice to help you implement these strategies effectively.

Learn More

• Register for our upcoming webinar on “Top 9 Actions to Reduce and Protect Your Cyber Attack Surface.”
• Visit Versa Networks for more information on SASE and SSE solutions that protect your attack surface holistically.