3.5.3. Attack Surface Management and Secure Development
💡 First Principle: Attack surface management treats the organization's entire external footprint as a continuous discovery problem — because attackers are constantly discovering assets organizations have forgotten, and unknown assets get no security attention.
Attack Surface Management (ASM) covers the full lifecycle of external exposure:
Edge Discovery — Identifying all internet-facing assets: domains, subdomains, IP ranges, cloud-hosted applications, third-party services. Many organizations have forgotten about old domains, development servers, or cloud instances that are still running and accessible.
Passive Discovery — Using OSINT techniques to discover assets without touching them: certificate transparency logs (every certificate issued for your domains is public), DNS enumeration, Shodan/Censys searches for your IP ranges.
Security Controls Testing — Validating that controls are working as expected: are firewall rules actually blocking what they should? Are WAF rules triggering on known attack patterns?
Penetration Testing and Adversary Emulation — Authorized attack simulations testing real-world exploitability. A penetration test validates that a vulnerability is exploitable, not just present. Adversary emulation (red teaming) simulates specific threat actor TTPs against real defenses.
Bug Bounty Programs — Invite external security researchers to find and responsibly report vulnerabilities in exchange for rewards. Provides continuous testing by diverse talent beyond internal capabilities.
Secure Coding Best Practices:
| Practice | What It Prevents | Example |
|---|---|---|
| Input validation | Injection, overflow, unexpected behavior | Reject inputs not matching expected type/length/format |
| Output encoding | XSS | HTML-encode user content before rendering |
| Session management | Session hijacking, fixation | Regenerate session ID on auth; set Secure and HttpOnly flags |
| Authentication controls | Credential attacks | MFA, account lockout, PBKDF2/bcrypt for password storage |
| Data protection | Sensitive data exposure | Encrypt at rest and transit; mask in logs and UI |
| Parameterized queries | SQL injection | Use prepared statements; never concatenate SQL |
Secure SDLC (Software Development Life Cycle) integrates security at every phase: threat modeling during design, SAST during development, code review, DAST during testing, and ongoing vulnerability management post-deployment. Security is built in, not bolted on.
Threat Modeling — Structured analysis of a system to identify potential threats, their likelihood, and mitigations. STRIDE framework: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege. Performed during design to catch architectural flaws before they're built.
⚠️ Exam Trap: Penetration testing and vulnerability scanning are complementary, not interchangeable. Scanning identifies potential vulnerabilities at scale. Penetration testing validates exploitability of specific vulnerabilities in the context of your actual environment and defenses. Scanning first; pentest to validate the critical findings.
Reflection Question: During a red team exercise, an attacker discovers a forgotten subdomain dev-api.company.com running an old API version with a known authentication bypass. The domain was used during development 2 years ago and never decommissioned. Which attack surface management practice would have detected this before the red team did?
