Skip to main content

CTEM-EXP-5 - Presumed Company System by Branding

To be Completed

Documentation has not been completed. This page is a placeholder for future documentation.

Presumed Company System by Branding refers to a system that has been discovered and appears to be owned by the organization based on its branding or other identifiable characteristics, although the connection to the organization is not explicitly confirmed. These systems are often marketing sites or other resources set up outside of the direct control of corporate IT, such as a WordPress site created by a regional marketing team, like one in the Philippines.

Characteristics of a Presumed Company System by Branding​

  • Branding Indicators: The system contains branding or references that make it appear to be affiliated with the organization. This could include logos, company names, or other identifiers that link it to the company.
  • Shadow IT Risk: These systems are often set up by employees or third parties without the involvement or oversight of corporate IT, which means they may not adhere to the organization's security policies or undergo proper scrutiny.
  • Public Exposure: These systems are typically accessible from the internet, making them vulnerable to attack if not properly secured. The lack of visibility and control by corporate IT can further exacerbate these vulnerabilities.

Common Methods of Discovery​

Presumed company systems by branding are typically discovered through:

  • Internet Scanning Tools: Tools like Shodan or Censys can be used to identify publicly accessible systems that appear to be associated with the organization based on branding or metadata.
  • Search Engines and Brand Monitoring: Search engines and brand monitoring tools can help identify systems that contain the company's branding, even if those systems are not directly managed by the organization.
  • Third-Party Intelligence: Threat intelligence services may detect systems referencing the organization, providing leads on potentially exposed and unmanaged assets.

Risks and Impact​

The risks associated with presumed company systems by branding include:

  • Brand Damage: If these systems are compromised, attackers could use them to distribute malware, host phishing campaigns, or deface the website, leading to brand damage and a loss of customer trust.
  • Loss of Confidentiality: Systems set up without proper oversight may inadvertently expose sensitive information, such as internal documents, customer data, or credentials, leading to a loss of confidentiality.
  • Shadow IT Challenges: These systems may not be subject to standard corporate security protocols, increasing the likelihood of misconfigurations and vulnerabilities that could be exploited by attackers.
  • Difficulty in Incident Response: Since these systems are not part of the official inventory, identifying ownership and implementing an effective incident response can be challenging, leading to delays in containment and remediation.

Key Considerations for Threat Exposure Management​

Managing presumed company systems by branding requires proactive monitoring, effective communication, and coordination across departments:

  • Brand Monitoring: Continuously monitor the internet for systems or domains that contain company branding. Set up alerts to identify when new systems appear that reference the organization, even if they are not officially sanctioned.
  • Shadow IT Identification and Management: Work to identify systems that are set up outside of IT's control. Develop policies to encourage employees to register and secure all systems, including those for marketing or regional use, with corporate IT.
  • Security Awareness and Training: Educate employees and third-party contractors about the risks of setting up branded systems without involving corporate IT. Emphasize the importance of adhering to the organization's security standards and the potential consequences of a compromise.
  • Vulnerability Management: Once presumed systems are identified, assess their security posture and work with the responsible parties to remediate any vulnerabilities. Implement a vulnerability management process that includes regular assessments of these systems.
  • Incident Response Planning: Develop an incident response plan that includes identifying and taking control of presumed company systems in the event of a compromise. This may include coordinating with external vendors or marketing teams to secure or decommission the system.

Presumed company systems by branding present unique risks due to their lack of oversight and potential misalignment with corporate security standards. Effective threat exposure management requires ongoing monitoring, employee education, and collaboration across the organization to minimize risks and ensure that all branded systems are managed securely.