What it means
Exposure describes the opportunities an attacker has to reach or use a system, service, weakness, or sensitive capability. Internet reachability is one important example, but internal networks, stolen identities, partner connections, and application permissions can also create access paths. Exposure is therefore relative to a starting point and a set of assumptions. A service may be reachable without being vulnerable, and a vulnerability may exist without being reachable from a particular location. Keeping these distinctions separate makes remediation decisions more accurate.
AN ILLUSTRATIVE SCENARIO
An internal reporting service gains a public route
A finance team moves a reporting application during a cloud migration. The software version stays the same, but a new network rule makes its administration interface reachable from the internet. That configuration change increases exposure without creating a new software vulnerability. The security team checks the actual route and access requirements, works with the owner to restrict administration, and confirms that ordinary staff can still use the reporting workflow.
Put it to work
- Identify the asset and the attacker starting point you are assessing. Map relevant network routes, identity requirements, application permissions, and connected services.
- Compare intended access with observed access using configuration review and authorized tests. Include internal and partner paths, not only a scan from the public internet.
- Reduce unnecessary paths and privileges, then retest. Record the owner, remaining access requirements, and changes that should trigger another review of the exposure.
How to check your work
Test from the specific locations and identities in your assessment. Confirm that prohibited access fails and required access still works. Document any assumptions, such as an upstream control or identity policy, on which that result depends.
Connect the ideas
- Vulnerability
A weakness in a system, process, or person that makes a loss easier to cause.
- Likelihood
How plausible it is that a threat will cause a loss in this environment, given exposure and evidence.
- Trust boundary
A place where identity, network, or data assumptions change and a fresh check is required.
- ASM
The ongoing discovery, assessment, and reduction of ways an attacker could reach or affect an organization’s assets. Its scope may include external, internal, and cloud environments.