With the expansion of cloud usage, the proliferation of SaaS, and the entrenchment of remote work, an organization's IT assets have expanded significantly beyond their internal networks. As a result, it is easy to fall into a situation where you don't know how far your company is under management, or there are servers and services that you don't know.

In this article, we will explain what EASM is, why it is needed now, and how it should be implemented and operated as an organization from a practical perspective.

---

Background: Expanding the external attack surface and difficulty in visibility

Traditional security measures have focused on perimeter defenses based on the premise of internal networks. Today, however, the attack surface is rapidly expanding, including virtual machines, containers, APIs, SaaS, and even systems managed by subcontractors and subsidiaries in the cloud.

In particular are the following "undergrunt assets".

• Cloud resources that have been built in the past and left unattended
• Public servers remaining when switching production and verification environments
• SaaS and APIs used by the development team
• Unused subdomains that remain registered in DNS

Attackers automatically scan these from the internet side to find vulnerable points and break in. In other words, assets that defenders don't know about are the "easiest entry points" for attackers.

Under these circumstances, "first knowing what is visible outside" is the first step in security measures. EASM plays an important role here.

---

What is EASM? Its role and characteristics

EASM (External Attack Surface Management) is an initiative to continuously discover and visualize your organization's IT assets visible from the Internet and manage risks. is.

The characteristic of EASM is that it does not rely on internal ledgers or configuration management information, but identifies assets from the same perspective as attackers (external perspectives). Specifically, it covers the following information:

• Public IP addresses, domains, and subdomains
• Web applications, API endpoints
• TLS certificate, cloud configuration information
• Known vulnerabilities and misconfigurations

This makes it possible to identify "assets that were not known internally but were fully visible from the outside." It's important to note that EASM is not just an inventory, but an operational security measure that continuously detects changes.

---

Attack Techniques and Risks Seen in EASM

EASM provides visibility into the following attack risks:

• Unused but public admin
• Vulnerabilities in outdated middleware and frameworks
• Authentication-free and accessible APIs
• Misconfigured cloud access control

They are frequently exploited as initial entry points for ransomware, information theft, and springboard attacks. In fact, many breach incidents are caused by "basic configuration failures" rather than "advanced zero-day attacks."

The greatest value of EASM is that it can detect these risks before they can be invaded.

---

Countermeasures: Steps to implement and operate EASM

To effectively utilize EASM, phased implementation and operation are crucial.

1. Define Coverage
   First, clarify how far you want to visualize, including your own domain, cloud environment, affiliates, and subcontractors.
2. Automatic asset detection and classification
   It utilizes EASM tools to automatically detect assets that are visible from the outside. Categorizing them by importance and application makes it easier to prioritize responses.
3. Risk Assessment and Corrective Response
   We will respond to discovered vulnerabilities and configuration deficiencies, such as fixing, suspending publication, and strengthening access control.
4. Continuous Monitoring
   Detect new asset emergencies and configuration changes to stay up to date. This is the big difference from a one-time inventory.
5. Integration into operational processes
   Incorporate EASM results into your development and operations flows, and make security a part of your daily operations.

---

What it should be: Security operation based on the attacker's perspective

The ideal that EASM aims for is to "always know how your organization is seen from the outside."
This is also highly compatible with the concept of Zero Trust, and it is important to design and operate on the premise that "what is outside is always targeted."

EASM is not a standalone solution.
Combined with cyber threat intelligence and SOC operations, it enables more effective defenses.

Related articles:

• Ransomware Protection Guide: A thorough explanation from attack methods to defense
• Identity Management in the Era of Zero Trust: A Practical Guide to Secure Access Control
• Cyber Threat Intelligence (CTI) Implementation Guide: Proactively Prevent Organizational Risk

---

Conclusion

EASM is an important initiative that supports the shift from "respond to attack" security to "crush before attacked" security.
In today's ever-increasing number of IT assets, the inability to understand the external attack surface is a major risk in itself.

First of all, know "what is visible outside".
Prioritizing and incrementally improving from there is a shortcut to realistic and effective security enhancement.
EASM is a very effective approach as a first step.