Understanding fluctuations in EASM inventory between scans

// Introduction to EASM Inventory Fluctuations

External Attack Surface Management (EASM) tools provide visibility into the assets exposed to the internet. Fluctuations in inventory between scans can reveal vulnerabilities or misconfigurations. Understanding these changes is essential for maintaining a robust security posture.

// Common Causes of Fluctuations

1. Changes in Network Configuration: New devices, reconfigurations, or even accidental deletions can alter your attack surface.

2. Service Updates: Updates to existing services or applications can introduce or remove vulnerabilities.

3. DNS Changes: Modifications in DNS records often impact discovered assets.

4. Expired Certificates: SSL/TLS certificates have lifecycles; expired certificates may lead to assets disappearing from scans.

5. IP Address Changes: DHCP may assign different IPs to devices, affecting their discoverability.

6. New Vulnerabilities: Discovering a new vulnerability can lead to additional assets being flagged.

7. Temporary Assets: Test and staging environments may appear and disappear between scans.

// Analyzing Your EASM Output

When analyzing scan results, focus on the following:

• Newly Discovered Assets - Identify what has been added since the last scan.
• Removed Assets - Determine if they were intended removals or accidental drops.
• Vulnerability Changes - Look for any new vulnerabilities introduced to existing assets.

Step-by-step Analysis

1. Run an EASM Scan: Use your EASM tool to generate a new inventory.

2. Export Scan Results: Export the results in a useful format, often CSV or JSON.

3. Compare with Previous Inventory: Use a diff tool to highlight differences.

   diff -u previous_inventory.csv latest_inventory.csv

4. Document Changes: Create a table summarizing what changed. Include: - Asset Name - Change Type (Added/Removed) - Vulnerability Status

5. Investigate Removals: For each removed asset, check logs to understand if it was intended or if it needs to be restored.

Log Analysis and Troubleshooting

Log files from your network devices and EASM tools can provide additional context regarding changes:

• Device Logs: Check the configuration changes.

   cat /var/log/syslog | grep 'config change'

• EASM Tool Logs: Look for any errors or warnings during scans.

   tail -n 100 /var/log/easm_tool.log

Example Scenario

Imagine an organization with a web application that undergoes a routine update. Post-update, the EASM tool reflects several assets as removed.

• Investigation: Upon checking logs, it was discovered that the update inadvertently changed the service running on a specific port, causing the EASM tool to miss the asset.

• Resolution: Reconfiguring the application to maintain the expected service port restored the asset's discoverability.

Defensive Implications

Frequent fluctuations in your EASM inventory can indicate misconfigurations ripe for exploitation. Here are some defensive strategies:

• Implement change monitoring on critical assets.
• Utilize alerts for significant changes in EASM findings.
• Regularly review and update asset configurations.

Checklist for Managing EASM Inventory Fluctuations

• [ ] Run EASM scan regularly.
• [ ] Document changes in assets systematically.
• [ ] Review device and application logs for anomalies.
• [ ] Maintain a change management process.
• [ ] Perform periodic audits of your network configuration.

By understanding and managing the fluctuations in your EASM inventory, you can significantly reduce potential attack vectors and maintain better control over your surface area.

--- // FIELDOPS REPORT AUTHORIZED BY: Alex J. //