External attack surface management (EASM) buyer's guide

Think about the security challenges you currently face, and how external monitoring could support you. Consider the different EASM functions and features outlined above. You may have any number of priorities, which could include:

• seeing your entire attack surface mapped out
• building an accurate record of your digital assets
• specific monitoring to meet compliance requirements
• ensuring email anti-spoofing controls are deployed
• prioritising support where you know you have multiple risks

The more specific your objectives for using an EASM product, the more likely you are to select one that’s right for you. Although every organisation is unique, below we’ve listed some scenarios that illustrate typical requirements. 

Example A: Small business

Organisation A is a small business with no in-house technical support. They have their own domain and run some websites, email, and online services developed some time ago by a third party.

Organisation A wants to focus on ensuring their online assets are not vulnerable, perhaps due to a lack of maintenance that has failed to keep software up to date. They want an EASM product that provides clear understandable advice on the risks and actionable information about what they need to do.

Example B: SME 

Organisation B has a number of subdomains created over many years to host various web services, many of which no longer exist. The organisation knows that not all subdomains will have been correctly decommissioned, possibly leaving some vulnerable to takeover by cyber criminals.

Organisation B wants to focus on identifying and removing these old subdomains. They want an EASM product that performs well at discovering subdomains, and detecting lots of different scenarios in which domains are vulnerable to takeover.

Example C: Large enterprise

Organisation C has a large IP address space hosting many different services across the business. They are aware that old and vulnerable software and services exist across their estate, that the security team are not aware of.

Organisation C wants to focus on identifying deprecated vulnerable services across a large number of IP addresses. They want an EASM product that can support large IP ranges, excels at service identification, and provides exports of risks to share with other teams.

An essential feature of EASM products is ongoing automated discovery of your attack surface. Discovery will typically blend many sources of technical and non-technical data, including public information such as DNS and certification information.

EASM products may offer additional API connectors to integrate with suppliers (such as cloud providers) to provide better coverage of your assets. You should consider which integrations, if any, you require to get the most value from your monitoring. 

Effective automated discovery will validate or ‘confidence score’ discoveries before presenting, and allow you to exclude any out-of-scope discoveries.

Consider who needs access to the information from the EASM product. Different users may need access to different information. Consider who needs to know about misconfigurations or vulnerabilities, and what actions will be taken. If you will be sending information to third party IT suppliers or security companies, consider what export features you might need.

Similarly, consider who needs to know information about the discovered attack surface, including IP addresses, domain names (including subdomains), certificates, websites, services, and any other externally discovered items. Different tools will have different ways of displaying this information. You should consider if you intend to export the data into existing tools, or would benefit from additional features within the EASM tool to view and analyse the data in place.

Most EASM products have export features, which can provide different types of files, for sharing with people who don’t have direct access to the EASM tool. If you are expecting to send information externally, ask to see example output from the providers you are considering. This can include:

• detailed information about a single issue (often exported as PDF files) which is useful for sending to colleagues or third parties so they can take remedial action to resolve the issue
• overviews designed for board-level understanding, often with charts and metrics
• full lists of issues (including types, severities and instances), often exported as CSV files which can be opened in Excel and other common tools

Most EASM products provide an interface accessible from a web browser. Some can provide integrations into your existing workflow or ticketing system. Think about how you want to use the EASM tool. Do you want it to push information to you, for example through email alerts? Or do you only want to log in and view the information when you choose?

Many of the additional EASM platform features can only be accessed if you log into the web interface. For less experienced users, this way of using the products is recommended. For organisations with established security monitoring, consider if a feed from the EASM product into your existing SIEM tool would be helpful, and check compatibility with the EASM providers.

You have the best understanding of your own business policies and context. Ask any prospective EASM supplier(s) what tools and features are provided for you to navigate the EASM data. Consider how you could identify issues or anomalies that might not automatically be raised as risks, but that are not acceptable for your business.

EASM products often identify a large number of issues with a wide range of severity. Consider how you will prioritise these risks and decide which actions to take first. You may wish to prioritise based on:

• where in the attack surface the issue is
• the likelihood of it being exploited
• the impact that could occur

Your EASM product should help you to focus on what matters most to your organisation, and to prioritise your actions. This can include:

• providing clear provenance of any discovered attack surface and all findings 
• incorporating threat intelligence, or annotating CVE vulnerabilities using the Known Exploited Vulnerabilities [KEV] Catalog from CISA
• providing accurate findings, and clearly marking any that have low confidence
• allowing removal of false positives
• the ability to accept or ignore specific risk instances or risk types
• workflow features or external workflow integrations
• integrations with suppliers such as cloud providers, certificate authorities or DNS providers to help quickly identify where action is needed

A primary benefit of EASM products is the continuous nature of the monitoring. How up to date this is depends on the frequency of the underlying scanning data and subsequent analysis. The more current the data is, the less time it takes to:

• identify and resolve risks
• reduce the time that your organisation is exposed
• validate that your actions have resolved the issues

Consider how important the timeliness of the data is to you. This might include updating hourly, daily or weekly. Note that the update frequency may not be the same for all types of checks within the tool, so be sure to ask prospective EASM providers about your specific requirements. Some products also offer on-demand scans to check immediately if you have resolved an issue.

EASM products can warn you if your systems are likely to be impacted by known vulnerabilities with assigned CVE numbers. This is often achieved by determining the version of the technologies you are using, and cross-checking this against the versions which are known to be vulnerable. These warnings will tell you if your software is out of date and needs patching.

Vulnerability assessment or vulnerability scanning is the practice of checking if live systems are definitely vulnerable to specific vulnerabilities, using carefully crafted non-malicious payloads to validate.

Some EASM products can integrate with vulnerability scanning tools, or offer vulnerability assessment as an additional feature. This often requires additional configuration and permissions, due to increasing the potential impact of the scans, and legal requirements. 

Consider if you require vulnerability assessment as part of your EASM offer. Before enabling features like this, you should understand how your organisation would respond to scans that might trigger other security software (such as an intrusion detection system). Ask any potential EASM provider(s) how you will be able to rapidly identify their traffic so your security teams don’t waste time investigating scans as potential attacks. 

Well-designed EASM products are responsible with their scans. They limit the impact on scanned services, both in terms of bandwidth and intrusion, and allow users to adjust tolerances. For vulnerability scanning in particular, traffic should be easily identifiable as originating from the EASM product, including by providing source IPs and marking traffic wherever practical (for example in HTTP User Agents).