Skip to main content

System Exposure

System Exposure is a category within the threat exposure management framework that deals with the risk of systems, often servers, being exposed to the internet. These systems can range from officially sanctioned marketing sites hosted on-premises or in the cloud to unintentionally exposed administrative interfaces, such as Plesk servers or DevOps tools. Additionally, this category often includes shadow IT systems that employees stand up for marketing, sales, or general IT purposes outside the organization's official infrastructure.

Characteristics of System Exposure​

  • Public Accessibility: The exposed systems are accessible from the internet, often due to incorrect configurations, lack of access controls, or the use of unmanaged infrastructure by employees.
  • Diverse Types of Systems: The exposed hosts can include a wide variety of systems, such as web servers, administrative interfaces, and development environments. Some of these may be intended for public use (e.g., marketing sites), while others are mistakenly exposed (e.g., internal admin panels).
  • Shadow IT: Systems set up by employees for specific purposes, such as hosting marketing campaigns or providing sales tools, often fall outside of the standard IT processes. These systems may lack the security controls enforced by the organization, increasing the risk of exposure.

Common Methods of Discovery​

System exposure is typically discovered through various means, including:

  • Internet Scanning Tools: Services like Shodan, Censys, or other internet scanning tools can identify exposed systems by scanning for open ports and accessible services across the internet.
  • Search Engines and Google Dorking: Basic web searches or Google dorking techniques can reveal systems and services that are unintentionally exposed and indexed by search engines.
  • Third-Party Threat Intelligence: Threat intelligence services may detect exposed systems that belong to the organization and alert the security team.

Risks and Impact​

The risks associated with system exposure include:

  • Unauthorized Access: Exposed systems are at risk of unauthorized access, which could lead to data breaches, service disruptions, or the installation of malicious software.
  • Sensitive Data Exposure: Systems that are not intended to be public may contain sensitive data, including customer information, intellectual property, or credentials that attackers can exploit.
  • Attack Surface Expansion: Exposed systems increase the attack surface of the organization, providing more entry points for attackers to exploit.
  • Shadow IT Management Challenges: Systems set up without IT oversight may lack proper security controls, making them vulnerable to exploitation and difficult for security teams to manage and secure.

Key Considerations for Threat Exposure Management​

Managing system exposure requires proactive identification, monitoring, and securing of exposed systems:

  • Continuous Discovery and Inventory Management: Continuously scan the internet to identify exposed systems belonging to the organization. Maintain an up-to-date inventory of all internet-facing systems, including those managed by employees outside the formal IT processes.
  • Access Controls and Hardening: Implement strict access controls for all internet-facing systems, ensuring that only authorized users can access them. Harden system configurations to reduce the risk of unauthorized access.
  • Employee Awareness and Shadow IT Policies: Educate employees about the risks of setting up systems without IT approval. Implement policies for shadow IT that require employees to involve the IT team when setting up new systems.
  • Monitoring and Incident Response: Monitor for any signs of unauthorized access or malicious activity on exposed systems. Develop an incident response plan to address incidents involving exposed systems, including steps to secure or take down improperly exposed hosts.

System exposure presents a significant risk to the organization's security posture, particularly when systems are unintentionally exposed or set up without proper security controls. Effective threat exposure management requires continuous monitoring, strict access controls, and employee engagement to reduce the likelihood of exposure and minimize the impact of such incidents.