SECURITYATLAS✳

✳ The reference desk / In practice

ASM

The ongoing discovery, assessment, and reduction of ways an attacker could reach or affect an organization’s assets. Its scope may include external, internal, and cloud environments.

Attack surface management

What it means

ASM helps an organization discover and track the systems, services, and access points that make up its attack surface. The external subset, often called EASM, looks outward at internet-facing assets; broader programs may also include internal and cloud resources. Product boundaries vary, so clarify the scope. Discovery is valuable because inventory can lag behind acquisitions, experiments, and supplier changes. A discovered hostname or address is a lead, not automatic proof of ownership, vulnerability, or authorization to test it aggressively.

See the idea / Vulnerabilities

Removing DNS can leave the service reachable.

Compare removing an owned campaign route with removing only its DNS record.

Synthetic discovery D155 records campaign.example.test at documentation address 198.51.100.90:80. Hosting records corroborate the retailer’s ownership and Sam’s authority; Maya may change and test this exact route. The plain-HTTP origin initially serves GET / using that Host value. Compare an approved route withdrawal plus DNS removal with DNS removal alone. No public service is contacted.

ASM: Compare removing an owned campaign route with removing only its DNS record. The chapter text below describes every state.Campaign route · external scope198.51.100.90:80 · GET / · plain HTTPD155 · owned and authorizedHost: campaign.example.testDiscovery + retained data remainMaya · configured changeNo configuration changeSame approved campaign scopeFresh request to known originOrigin probe not runControl: shop.example.testV155 · selected-route recordNo V155 recordedWider retirement work openDISCOVERY ≠ RETIRED SERVICE

01 / 04

Establish facts

D155 retains the reachable campaign route. Hosting records establish ownership and authority before any change.

More about this step

This exercise starts after discovery and owner reconciliation. The known origin is 198.51.100.90:80; HTTP Host campaign.example.test selects GET /. Sam approves withdrawal of this obsolete campaign route, and Maya is the authorized operator. A DNS association alone would not establish ownership or permission. The original discovery record and campaign data remain.

Keep in mindThis is one authorized external HTTP route, not the whole attack surface. A 410 proves the selected resource was unavailable in this check; it does not prove host shutdown, data deletion or safe retirement of every path. Other ports, protocols, retained data and reappearance checks remain separate work.

Read the visual, step by step

Route + DNS

  1. Establish facts. D155 retains the reachable campaign route. Hosting records establish ownership and authority before any change. This exercise starts after discovery and owner reconciliation. The known origin is 198.51.100.90:80; HTTP Host campaign.example.test selects GET /. Sam approves withdrawal of this obsolete campaign route, and Maya is the authorized operator. A DNS association alone would not establish ownership or permission. The original discovery record and campaign data remain.
  2. Apply change. Maya withdraws the selected origin route and removes its DNS A record. The independent probe is still pending. The primary change disables the campaign’s HTTP route and removes its DNS A record. The comparison removes only DNS. These are distinct controls; neither a dashboard disappearance nor DNS removal shuts down the origin by itself. The modeled change leaves a second virtual host and retained data intact. The original D155 record stays available; no probe has yet verified the result.
  3. Probe origin. A fresh request to the known origin with Host campaign.example.test receives a bodyless 410. The separate control site still works. Maya’s independent probe dials the known origin directly and sends GET / with Host campaign.example.test. It does not use the removed DNS record. Route withdrawal yields bodyless 410 Gone; DNS-only removal yields 200 with the form. A separate Host shop.example.test still returns 200 in both runs. This isolated plain-HTTP lab models virtual hosting; it does not claim an HTTPS or public-network test.
  4. Record scope. V155 records the withdrawn HTTP route and successful control check. Data handling and future discovery remain open. V155 cites D155, the configured change and the independent selected-route/control responses. It records route withdrawn in the primary run, or still reachable in the DNS-only run. It does not record host deletion or complete retirement. Owner decisions about retained data, other routes and recurring discovery remain unfinished. This record is saved locally; no downstream receipt is implied.

DNS only

  1. Establish facts. D155 retains the reachable campaign route. Hosting records establish ownership and authority before any change. This exercise starts after discovery and owner reconciliation. The known origin is 198.51.100.90:80; HTTP Host campaign.example.test selects GET /. Sam approves withdrawal of this obsolete campaign route, and Maya is the authorized operator. A DNS association alone would not establish ownership or permission. The original discovery record and campaign data remain.
  2. Apply change. Maya removes only the DNS A record. The selected origin route remains configured to serve the campaign form. The primary change disables the campaign’s HTTP route and removes its DNS A record. The comparison removes only DNS. These are distinct controls; neither a dashboard disappearance nor DNS removal shuts down the origin by itself. The modeled change leaves a second virtual host and retained data intact. The original D155 record stays available; no probe has yet verified the result.
  3. Probe origin. A fresh request to the known origin with Host campaign.example.test receives 200 and the campaign form. DNS removal did not withdraw the route. Maya’s independent probe dials the known origin directly and sends GET / with Host campaign.example.test. It does not use the removed DNS record. Route withdrawal yields bodyless 410 Gone; DNS-only removal yields 200 with the form. A separate Host shop.example.test still returns 200 in both runs. This isolated plain-HTTP lab models virtual hosting; it does not claim an HTTPS or public-network test.
  4. Record scope. V155 records a still-reachable campaign route. Service withdrawal remains unfinished despite the missing DNS record. V155 cites D155, the configured change and the independent selected-route/control responses. It records route withdrawn in the primary run, or still reachable in the DNS-only run. It does not record host deletion or complete retirement. Owner decisions about retained data, other routes and recurring discovery remain unfinished. This record is saved locally; no downstream receipt is implied.

This is one authorized external HTTP route, not the whole attack surface. A 410 proves the selected resource was unavailable in this check; it does not prove host shutdown, data deletion or safe retirement of every path. Other ports, protocols, retained data and reappearance checks remain separate work.

Flow references: NCSC: external discovery, analysis and risk monitoring · RFC 9110: Host routing and 410 Gone

AN ILLUSTRATIVE SCENARIO

Missing DNS, reachable campaign form

D155 identifies a synthetic campaign route at a known HTTP origin. After ownership and change authority are established, Vera compares route withdrawal plus DNS removal with DNS removal alone. A fresh direct-origin request with the original Host value returns bodyless 410 in the first run, but 200 with the form in the second. Another virtual host still works. V155 records this selected route, while data retention and future discovery remain open.

Put it to work

  1. Start with known domains, address ranges, cloud accounts, and business entities. Combine technical discovery with owner interviews and existing inventory, noting uncertain ownership.
  2. Validate discovered assets and assign accountable owners. Establish which services are necessary, what they expose, and whether the organization is authorized to inspect or change them.
  3. Track remediation or retirement and monitor for reappearance. Keep evidence of ownership decisions, approved exceptions, and dependencies that could make a shutdown disruptive.

How to check your work

Choose a newly discovered asset and reconcile it with an owner and inventory record. After an approved change, verify the actual external state and any affected business function, rather than relying only on a finding disappearing.

Connect the ideas

  • Asset

    Anything whose disclosure, alteration, destruction, or downtime would harm a person or organization.

  • Exposure

    Whether and how a vulnerability or service can actually be reached in this environment.

  • DNS

    The lookup system that maps a name people type to an address a computer can contact.

  • CTEM

    A program for repeatedly finding, prioritizing, and reducing exposed attack surface rather than running a yearly scan.

Explore a field lesson

Find your next idea.

Tip: press / to open search. Escape closes this window.