Attack Surface Management - BETA

Core Concepts #

• Collection: A collection represents the segment of your network that will be scanned for vulnerabilities.
• Assets: Edgio identifies the hostnames and IP addresses associated with a scanned network segment. These entries are collectively known as assets.
• Exposures: Edgio scans your network for Common Vulnerabilities and Exposures (CVE). A CVE represents a known security vulnerability or exposure for a software package.
• Protections: Edgio identifies the security solutions that are protecting the assets associated with the scanned network segment.
• Technologies: Edgio identifies the software and services used by the assets associated with the scanned network segment.
• Rules: Determines how vulnerabilities and exposures are detected and handled.

How Does It Work? #

Getting Started #

1. Create a collection (Attack Surfaces | Collections | + Create Collection) and then add one or more seed(s) to your collection.
2. Scan your network.
3. Review and mitigate exposures.

Collections #

Managing Collections #

1. Load the Collections page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Collections.
2. Click + Create Collection.
3. From the Name option, assign a name to this collection.
4. Optional. From the Description option, provide a brief description for the purpose of this collection.
5. Optional. Define a schedule for when Edgio will scan your network.
   1. Mark each day of the week on which Edgio will scan your network.
   2. Select the time (UTC) at which the scan will start.
6. Optional. Define when notifications will be sent.
   • Scan Start: Require Edgio to notify you when it starts scanning your network by marking the Send email on scan start option. Disable this notification by clearing this option.
   • Scan Start: Require Edgio to notify you when it completes a network scan by marking the Send email when a scan completes option. Disable this notification by clearing this option.
   • Scan Start: Require Edgio to notify you when it detects new exposures or if existing exposures have been resolved by marking the Only send when new exposures are found or existing exposures are resolved option. Disable this notification by clearing this option.
   If you have enabled at least one notification, then you should define the set of users that will be notified. From the Recipients section, click within the option and then select the desired user. Repeat as needed.
7. Click Create Collection.
   Once you have created a collection, you should add seeds that define the segment of your network that will be scanned.

1. Load the Collections page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Collections.
2. Click on the desired collection.
3. Click + Add a Seed.
4. From the Type option, select the type of seed (e.g., domain, IP address, or GitHub repository) that will be added.
5. Perform one of the following steps:
   • Domain: From the Seed option, type the name of the domain (e.g., example.com) that will be scanned.
   • GitHub Repository:
     1. From the Seed option, type the repository path (e.g., edgio-docs\edgio-docs). A repository path typically identifies the owner of the repository (e.g., an organization or a user), a slash, and then the name of the repository.
     2. From the GitHub Personal Access Token option, provide a personal access token through which Edgio will access your repository.
     3. From the Branches, type one or more branch(es) that will be scanned. Use a comma to delimit each branch.
     4. From the Linked hostnames option, type one or more hostname(s) associated with the specified branches. Use a comma to delimit each hostname.
   • IP Address: From the Seed option, type the desired IP address.
   • IP Address Range: From the Seed option, type the desired IP address range or IP address block. Use CIDR notation.
     Sample IP address range: 192.0.2.10-100
     Sample IP address block: 192.0.2.0/24
6. Click Create Seed.

1. Load the Collections page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Collections.
2. Click on the desired collection.
3. Perform one of the following tasks:
   • Add a seed.
   • Modify a seed:
     1. From the Seeds section, click on the desired seed.
     2. Make the desired changes.
     3. Click Apply Changes to save your changes.
   • Delete a seed:
     1. From the Seeds section, click on the desired seed.
     2. Click Delete.
     3. When prompted, click Delete Seed to confirm the deletion.
   • Update the name, description, schedule, or notifications:
     1. Click Edit Collection.
     2. Perform the desired changes.
     3. Click Apply Changes to save your changes.

1. Load the Collections page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Collections.
2. Click the

   

   (Delete) icon next to the collection that should be deleted.
3. When prompted, confirm the deletion by clicking Delete.

1. Load the Collections page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Collections.
2. Click on the desired collection.
3. From the Reset Collection section, click Reset Collection.

Scanning Your Network #

• Your initial scan will detect and scan all of your assets. It will also place your assets under management until your organization’s limit is reached. If the number of detected assets exceeds your organization’s limit, then Edgio prioritizes hostnames over IP addresses.
  For example, let’s assume that your organization has 100 hostnames and 600 IP addresses. If your organization’s limit is 500 assets, then Edgio will place 100 hostnames and 400 IP addresses under management.
• Subsequent scans will only scan managed assets.
• You may also add or remove assets from management.
• Create or modify rules to create custom exposure detection and to determine whether exposures are created from findings discovered from scanned assets.
  For example, the default behavior is to scan ports for technologies, protections, and exposures. However, you can create a rule that prevents exposures from being created from port scans.

1. Load the Collections page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Collections.
2. Click on the desired collection.
3. Click Scan Now.

Rules #

• Findings: Edgio scans your organization’s managed assets for known vulnerabilities to discover findings. Rules determine the types of exposures that Edgio will create based on these findings.
• Custom Criteria: Configure a rule to add custom checks to a scan.
  For example, a rule can create an exposure when it detects a response header with a specific value.

• Determine whether exposures are reported when specific conditions are met.
• Customize the severity, priority, and assignee when specific conditions are met.
• Specify which ports are scanned on a per asset basis.

• Edgio will not create an exposure unless a finding matches at least one rule that is configured to create an exposure.
• Edgio provides a default rule set that you can use as a starting point. This rule set creates exposures for all findings.
• Rules are processed in the order that they are listed. If a finding satifies multiple rules, then all of those rules are applied to it. Edgio resolves conflicts by giving precedence to the rule that is closest to the bottom of the list.
  For example, if both rules #4 and #6 apply to a finding, then precedence is given to rule #6.
• Determine whether a rule applies to a finding by defining one or more condition(s).

1. Load the Rules page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Rules.
2. Click + Create Rule.
3. Define one or more condition(s) that identify the findings to which this rule will be applied.
   1. Select a type of condition.

      

   2. Define when that condition will be met.
      • Severity: Select an operator and a number from 0 (lowest) to 10 (highest) that represents the potential impact of an exposure.
        Example: Severity is greater than 3.7
      • CVE ID: Select an operator that defines the relationship with a CVE ID.
        Example: CVE ID equals CVE-2024-3094
      • CWE ID: Select an operator that defines the relationship with a Common Weakness Enumeration ID.
        Example: CWE ID equals CWE-787
      • Response Header: Type the name of the desired response header, select an operator, and then define the desired response header value.
        Example: Response Header cross-origin-opener-policy does not equal same-origin
      • Open Port: Define a port or a range of ports for which Edgio will check to see if they are open.
        Example: Open Port 21-23
      • TLS Cert Is Missing: This condition is satisfied when the asset is missing a TLS certificate.
      • TLS Cert Days Until Expiration: Select an operator that defines the relationship with the number of days before the asset’s TLS certificate expires.
        Example: TLS Cert Days Until Expiration is less than 30
      • TLS Cipher: Select an operator that defines the relationship with a TLS cipher.
      Example: TLS Cipher matches .*(?:DES|RC4|MD5|EXPORT|NULL).*
      • TLS SNI Hint Mismatch: This condition is satisfied when the request’s SNI hint does not match a value defined within the asset’s TLS certificate.
   3. Repeat the previous step as needed. If you have defined multiple conditions and would like to make them all mandatory, then you should select All of from the When Any of the following finding criteria are met option.
4. From the Action option, choose how findings that satisfy this rule will be handled.
   • Create an exposure with following values: Select this option to create an exposure.
     1. Optional. From the Assign user option, select a user to which this exposure will be assigned by default.
     2. Optional. From the Assign priority option, select the default priority that will be assigned to this exposure.
     3. Optional. From the Assign severity option, select the default severity that will be assigned to this exposure.
     4. Optional. From the Assign summary option, provide a brief summary of this finding. You may include variable data, such as $summary, $cve, or $hostname.
   • Don’t create an exposure: Select this option if an exposure should not be created for findings that match this rule.
   • If another rule creates exposure, assign values: Select this option to override the user, priority, and severity assigned to a previously discovered exposure.
5. Restrict this rule by collection. From the Collections option, select one of the following options:
   • Applies to all collections: Applies this rule to all collection.
   • Only applies to specific collections: Applies this rule to the selected collections. Click directly below this option and select each desired collection.
   • Applies to all collections except: Applies this rule to all collections except for those that have been selected. Click directly below this option and select each collection to which this rule will not be applied.
6. Restrict this rule by asset. From the Assets option, select one of the following options:
   • Applies to all assets: Applies this rule to all assets.
   • Applies to assets matching any of the following criteria: Applies this rule to a finding that matches at least one condition. Define one or more condition(s) for identifying assets.
   • Applies to assets matching all of the following criteria: Applies this rule to a finding that matches all specified conditions. Define one or more condition(s) for identifying assets.
   Define a condition by performing the following steps:
   1. Click + Add Criteria.
   2. Select the type of asset (e.g., hostname or IP address).
   3. Select an operator that defines the relationship with the value specified in the next step.
   4. Specify a value.
   Sample condition: Hostname matches .*(example.com)
7. Determine whether to stop processing a finding when this rule is satisfied.
   • Allow subsequent rules to process by setting the Exit on match option to

     

     (off).
   • Stop processing when this rule is satisfied by setting the Exit on match option to

     

     (on).
8. From the Rule description option, type a brief description for this rule.
9. From the Enabled option, determine whether this rule will be enabled.
10. Click Create Rule.

1. Load the Rules page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Rules.
2. Click on the desired rule.
3. From the Enabled option, determine whether this rule will be:
   • Enabled: It should look like this:

     

   • Disabled: It should look like this:

     

4. Click Apply Changes.

1. Load the Rules page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Rules.
2. Click on the desired rule.
3. Make the desired changes.
4. Click Apply Changes.

1. Load the Rules page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Rules.
2. Click on the Scan common remote access ports rule.
3. From the Action option, select Don't create an exposure.
4. Click Apply Changes.
   Subsequent scans will continue to scan open ports for technologies and protections. However, exposures will not be generated from those scans.

1. Load the Rules page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Rules.
2. Click the

   

   (Delete) icon next to the rule that should be deleted.
3. When prompted, confirm the deletion by clicking Delete.

Exposures #

• ID: An identifier comprised of the collection name and an incrementing number.
• Summary: A brief description of the exposure.
• Asset: The asset (e.g., a hostname, IP address, or seed) on which the exposure was detected.
• Severity: The potential impact of an exposure is reported as a number from 0 (lowest) to 10 (highest).
• Priority: The priority of the exposure (Low, Medium, High, or Critical). Use priority to indicate the urgency with which the exposure should be addressed.
• Assignee: The user or team that is responsible for addressing the exposure.
• Status: The status of the exposure: Valid values are:
  • New: The exposure has been created, but has not been reviewed.
  • Acknowledged: The exposure has been reviewed.
  • Resolved: The exposure has been addressed.
  • Mitigated: The exposure still exists, but the risk has been reduced.
  • Muted: The exposure has been muted, optionally until a specific date.
  • Ignored: The exposure has been ignored.
• Technology Version: Optional. The specific version of the technology that is associated with the exposure.
• CVE: Optional. The CVE that is associated with the exposure.
• Comments: Optional. Users can add comments to exposures to provide additional context or information.

• Track changes to that exposure.
• Add comments.
• View detailed information about how an exposure was detected.

Assets #

1. Load the Assets page.
   1. From the Edgio Console, select the desired organization.
   2. From the Security section, click Attack Surface.
   3. From the left-hand pane, select Assets.
2. Find the desired asset.
3. From the Under Management column, determine whether Edgio may scan it for exposures.
   • Managed Asset: Set this option to

     

     (on).
   • Unmanaged Asset: Set this option to

     

     (off).

Protections #

• SQL Injection
• Cross Site Scripting (XSS)
• Command Injection
• Local File Inclusion (LFI)
• XML External Entity Injection (XXE)

Technologies #