Many times people asked me about the differences between external attack surface management, vulnerability management, and penetration testing. Mostly “What will be the and the right approach to handling security tools alongside the behavior and procedures. While many organization has tons of security tools with a big overlapping, there are many differences between those areas, and we can apply each approach based on the requirements we have and the approach we want to adopt.

In today’s rapidly growing digital landscape, cybersecurity is a crucial consideration for organizations. Three fundamental practices – Penetration Testing, External Attack Surface Management, and Vulnerability Management – form the cornerstones of a robust cybersecurity strategy. But what do they entail, and how do they differ from each other? This post provides information, tips, and a look into the differences between EASM vs. PT vs. VM and how Defender EASM can play a crucial part in your environment.

First, let’s start with a funny and unreal story about the Dragon and Cloud computing.

“The Epic Battle: Dragon and the Cloud Computing – A Hilarious Showdown!”

Once upon a time, in the realm of technology, an unexpected and comical event unfolded. A fearsome dragon known for its fiery breath and colossal strength inexplicably developed a grudge against the concept of cloud computing. The dragon, with its archaic mindset, believed that all data should be physically stored in cavernous dungeons guarded by its scaly brethren. What ensued was a whimsical clash between ancient beliefs and cutting-edge technology, resulting in a hilarious spectacle for all to witness.

As the dragon dived down from the mountains, causing a stir in the digital skies, the cloud computing systems watched in confusion. The compute, adorned with fluffy white clouds, quivered with nervous excitement. This was no ordinary battle; it was a clash of worlds—a mythical creature versus a revolutionary technological marvel. The dragon, with fire in its eyes, tried to engulf the cloud servers with its flames. Little did it know that the data it sought to destroy was safely stored across multiple data centers scattered worldwide. The dragon’s fire, instead of scorching the servers, merely tickled them with warmth, evoking a giggle from the cloud data.

Undeterred, the dragon resorted to its ancient knowledge and tried to gnaw at the cables connecting the servers. However, the cables proved to be far too elusive, slithering away like playful serpents, teasing the dragon and causing it to stumble in frustration. As the dragon grew more desperate, it attempted to use its wings to blow away the digital infrastructure. But the cloud servers were prepared for such antics. They summoned a virtual shield, resembling a gigantic umbrella, that resisted the dragon’s gusts with an impeccable sense of style. The cloud servers knew how to stay cool under pressure, quite literally!

The battle continued with the dragon resorting to unconventional tactics. It tried to intimidate the cloud servers by bellowing ancient curses, only to be met with automated responses of witty comebacks. The servers’ quick thinking and sarcastic humor had the dragon scratching its scales in confusion. In the end, as dusk settled over the digital realm, the dragon realized the futility of its mission. With a mix of embarrassment and awe, it retreated to its mountains, leaving the cloud computing systems to continue their revolutionizing work. The dragon’s attack had unintentionally made cloud computing even more popular, with people marveling at the ingenuity and resilience of this modern marvel.

And so, the legend of the dragon attacking cloud computing became a beloved tale, told around campfires and shared through countless memes. It served as a reminder that even the fiercest opponents can sometimes stumble upon the comical side of the ever-evolving technological landscape.

Dragons aren’t real, and Cybersecurity isn’t a comic story. The reality is that cloud vendors are attacked on a daily basis with many successes and a lot of damage to the organization. Now, let’s go back to the real world… with external attack surface management, vulnerability management, and penetration testing.

Penetration Testing: The Proactive Defense

Imagine hiring a skilled thief to test the integrity of your home security system. That’s essentially what penetration testing is in the cyber world. It’s a proactive approach to cybersecurity where ethical hackers attempt to breach a system’s defenses, simulating attacks to uncover potential vulnerabilities.

Penetration testing can reveal how well a system can defend against attacks, highlight weaknesses in that defense, and provide an opportunity to improve it. The key difference here lies in the active methodology of trying to “break into” the system. The focus is on exploiting known vulnerabilities and identifying unanticipated ones before malicious hackers do.

The idea behind pen testing is relatively straightforward: to identify how resilient an organization’s IT environment is against cyber threats. However, the execution is far from simple. It requires an in-depth understanding of the organization’s IT landscape, potential threat vectors, and the expertise to mimic the strategies and methods employed by real-world hackers.

Penetration testing typically involves the following key stages:

• Planning and reconnaissance: At this stage, the scope and goals of the test are defined. Information is gathered regarding the target system to understand its potential vulnerabilities better.
• Scanning: This step involves understanding how the target application or system responds to intrusion attempts. It may involve static and dynamic analysis.
• Gaining Access: Here, the pen tester uses web application attacks, such as cross-site scripting, SQL injection, and backdoors, to uncover a target’s vulnerabilities. The goal is to exploit these vulnerabilities to extract valuable data or disrupt services.
• Maintaining Access: The goal in this stage is to see if the vulnerability can be used to achieve a persistent presence in the exploited system—mimicking advanced persistent threats, which often remain in a system for months in order to steal an organization’s sensitive data.
• Analysis and Reporting: This final step involves compiling a report detailing the vulnerabilities found. These data were accessed, and how long the pen tester was able to remain in the system.

Tip: Do you know what is the SRM for Cloud PT? Below is a table with a few highlights.

Penetration testing could be automated with software applications or performed manually. The most effective approach often combines both. It’s also crucial to remember that pen testing is not a one-off activity. Given the evolving nature of cyber threats, regular pen tests should be conducted to keep up with emerging vulnerabilities.

More about Cloud PT in the following post: https://cyberdom.blog/2023/03/04/cloud-penetration-testing-from-the-field/

External Attack Surface Management: A Bird’s Eye View

External Attack Surface Management is all about maintaining visibility and control over an organization’s digital presence. It involves identifying, managing, and securing all externally visible assets of an organization, ranging from servers and domains to cloud services and digital assets associated with third-party partners.

The goal is to reduce the total number of potential entry points, or the “attack surface,” that a hacker could use to gain unauthorized access. By gaining a comprehensive view of all assets that could potentially be attacked, an organization can secure these assets proactively, mitigating the chance of a security breach.

In its simplest form, EASM is about understanding everything about your organization that’s accessible from the internet. It’s all about getting a comprehensive “bird’s eye view” of your organization’s digital presence. This means identifying and managing all the digital assets that can be seen and potentially exploited by outside attackers.

Think about your organization as a physical building. The external attack surface would be every single entry and exit point to the building – doors, windows, vents, etc. In the digital context, your attack surface comprises every device, server, application, domain, subdomain, and even cloud storage database that can be accessed from the internet. It also includes digital assets that might be associated with third-party partners who have links to your systems.

Management of this surface requires detailed and ongoing inventory and tracking of these digital assets. You need to know what they are, where they are, their security status, and who has access to them. This information is vital because each asset can potentially be a point of vulnerability that attackers could exploit.

But it’s not just about knowing your assets; it’s also about securing them. You need to continuously scan these assets for vulnerabilities, assess the risks associated with them, and patch them when necessary. Regularly updating and maintaining these assets, and in some cases decommissioning those that are no longer necessary, can help reduce the overall attack surface.

The objective of EASM is not just to understand your attack surface but also to minimize it, thereby reducing the risk of a security breach. This process is continuous – as the digital landscape of an organization evolves, new assets will come into play, and others will become obsolete. Therefore, EASM is not a one-time event but an ongoing practice that needs to keep pace with the dynamism of digital transformation.

Scenario: A Growing Company

Consider a tech startup that has experienced rapid growth. Initially, the company started with a small team and a single website, making their digital assets easy to manage. However, as the company grows, so does its digital footprint. They deploy several cloud-based applications, utilize multiple servers across various regions, maintain multiple websites and microsites for different services, and use third-party vendors for services like customer support, email marketing, payroll, and more.

Each of these assets – the websites, cloud applications, third-party services, and even the devices used by remote workers – forms part of their external attack surface. As the organization grows, its attack surface expands and becomes more challenging to manage.

EASM Implementation

To manage this growing attack surface, the company must first map all its external digital assets. It uses automated tools that crawl the web, looking for any assets tied to the company’s domains and IP addresses. These tools help the company identify not just known assets but also forgotten or unknown assets that could pose a risk.

Once these assets are identified, the company classifies them based on factors like their importance to business operations, the sensitivity of the data they hold, and the potential impact if they were compromised. This classification helps prioritize security efforts.

The company then continuously scans these assets for vulnerabilities. For instance, they may find that a server hosting a microsite is running outdated software with known vulnerabilities. They might discover misconfigured cloud storage buckets containing sensitive information exposed to the internet. They could find services from a third-party vendor that aren’t properly secured, potentially giving attackers a way in.

Upon finding these issues, the company takes steps to secure these assets. They update the outdated server software, correct the cloud storage configurations, and work with their third-party vendor to secure the exposed services. They also decommission old assets that aren’t needed, further reducing their attack surface.

Finally, the company ensures that EASM is an ongoing process. They understand that their attack surface is dynamic and continuously evolving, so they keep monitoring, identifying new assets, and checking for vulnerabilities.

By implementing EASM, the company gains a comprehensive view of its attack surface and can take proactive steps to secure it. They can identify risks they weren’t previously aware of and secure vulnerabilities before attackers can exploit them. As a result, they’re much more secure than they would be otherwise, reducing the likelihood of a successful cyber attack and strengthening their overall cybersecurity posture.

An attack surface comprises all the different points where an unauthorized user (the attacker) can try to enter data to or extract data from an environment.

Reducing the attack surface involves several strategies:

• Proactively Mapping the Digital Footprint: This means understanding all of the organization’s digital assets, including those on-premises, in the cloud, subsidiaries, and third-party or partner environments. Knowing where data is stored and how it is accessed is key in this process. This also extends to devices like laptops, mobiles, and IoT devices used by employees.
• Monitoring Online Channels for Attack Indicators: Cyber threat intelligence can provide valuable insights into what vulnerabilities are being exploited in the wild and what methods attackers are using. This can include monitoring for specific attack patterns, behavior, or suspicious activities that may indicate a breach.
• Quickly Defusing Identified Threats: When a threat is identified, organizations need to act swiftly to mitigate the risk. This can involve patching vulnerabilities, blocking malicious IP addresses, strengthening access controls, or even disconnecting compromised systems from the network.
• Protecting Customers, Employees, and Networks: Organizations should have policies and procedures in place to educate their stakeholders about the risks and best practices. This can include things like secure password policies, multi-factor authentication, VPN for remote access, regular updates and patches, and awareness training for phishing and other social engineering tactics.

Vulnerability Management: Continuous Vigilance Against Threats

Vulnerability Management is a systematic, ongoing process of identifying, classifying, prioritizing, remediating, and mitigating software vulnerabilities. It encompasses software vulnerabilities in a system or a network, outdated systems, and more.

Being both preventive and ongoing, this process aims to keep systems up-to-date and resistant to known threats. Vulnerability management focuses on managing known vulnerabilities and risks and constantly updating these defenses as new vulnerabilities are discovered.

VM is an ongoing task due to the constant emergence of new threats and the frequent updates and changes in IT systems.

Here’s a more detailed breakdown of the steps involved in a typical Vulnerability Management process:

• Identify Vulnerabilities: The first step is to identify the existing vulnerabilities. This is usually done through vulnerability scanning using automated tools, which can check systems, networks, and applications for known vulnerabilities.
• Analyze and Prioritize Vulnerabilities: Once the vulnerabilities are identified, they need to be analyzed and prioritized based on their severity. This typically involves understanding the potential impact of the vulnerability, the systems it affects, and the likelihood of it being exploited. The goal is to address the most critical vulnerabilities first.
• Remediate or Mitigate Vulnerabilities: The next step is to address the vulnerabilities. This can involve patching the vulnerability, changing configurations, adding additional security controls, or even replacing the vulnerable system. In some cases, if patching is not immediately possible, temporary measures might need to be implemented to mitigate the risk.
• Repeat the Process: Vulnerability management is a continuous process, not a one-time task. The process should be repeated regularly to discover new vulnerabilities, as well as to verify that previous vulnerabilities have been effectively remediated.
• Reporting: Regular reporting on vulnerabilities, the actions taken, and any incidents that have occurred is crucial. This can help management understand the organization’s security posture and make informed decisions.

Vulnerability Management is often seen as a reactive process, as it involves responding to known vulnerabilities. However, a proactive and regular approach to VM can help prevent security incidents from occurring in the first place.

The Triad in Action: Security for Cloud Environments

Consider the cybersecurity requirements for cloud environments, which are multifaceted and complex. They demand a holistic approach that involves all three of these elements. Regular penetration testing helps identify security gaps in your cloud infrastructure configurations, applications, and data storage practices. External Attack Surface Management becomes crucial in the cloud, where connections to and from various external systems can create a vast attack surface. Vulnerability Management in the cloud keeps systems patched, updated, and regularly scanned for vulnerabilities.

A Synergy for Robust Cybersecurity

The unique strengths of Penetration Testing, External Attack Surface Management, and Vulnerability Management form a triad that fortifies cybersecurity. While each has a distinct focus and methodology, together, they weave a robust shield against cyber threats. The best approach for any organization is to integrate these practices into a comprehensive, proactive cybersecurity strategy, tailoring the importance of each based on specific usage, data sensitivity, and regulatory requirements.

By understanding these three practices and how they work together, organizations can significantly enhance their resilience against cyber threats, safeguard their digital assets, and ensure they’re ready to face the rapidly changing cybersecurity landscape.

Cloud environments have become a critical part of modern IT infrastructures. Given the complexity and scale of cloud environments, ensuring their security is a significant challenge. Implementing the triad of Penetration Testing, External Attack Surface Management, and Vulnerability Management can significantly enhance the security posture of cloud environments.

Penetration Testing: The Proactive Defense – In the context of cloud environments, penetration testing helps identify vulnerabilities that could be exploited by malicious actors. This involves simulating attack scenarios that real-world hackers might use to gain unauthorized access to the cloud infrastructure. Pen testing in a cloud environment could uncover issues such as misconfigurations, weak security controls, and vulnerabilities in applications hosted in the cloud.

The insights obtained from pen testing provide valuable inputs to secure the cloud environment, like strengthening firewall rules, correcting security group settings, or fixing application-level vulnerabilities.

External Attack Surface Management: A Bird’s Eye View of Vulnerabilities – With the shift to the cloud, the attack surface has expanded significantly. Organizations often use a mix of public and private cloud services, various Software as a Service (SaaS) applications, and numerous APIs, all of which increase the attack surface.

External Attack Surface Management in cloud environments involves continuously mapping and monitoring all cloud-based assets. This includes securing public-facing virtual machines, ensuring that cloud storage buckets are properly configured and not publicly accessible, and checking that APIs are secure and only provide the necessary access.

EASM in the cloud enables an organization to maintain a clear view of its digital exposure in the cloud, ensuring all cloud-based assets are accounted for and secured.

Vulnerability Management: Continuous Vigilance Against Threats – In cloud environments, vulnerability management is crucial due to the dynamic nature of the cloud. Assets in the cloud can be quickly spun up and down, configurations can change rapidly, and new services and applications can be deployed at a rapid pace.

Effective vulnerability management in the cloud involves regularly scanning for vulnerabilities, prioritizing them based on risk, and then patching or mitigating these vulnerabilities. It also requires working closely with cloud service providers to understand any new threats or vulnerabilities associated with their services and how to address them.

The Triad in Action

When combined, Penetration Testing, External Attack Surface Management, and Vulnerability Management form a robust security strategy for cloud environments.

Penetration testing provides a proactive way to test the defenses of the cloud environment. EASM provides a comprehensive view of the organization’s cloud-based digital exposure, ensuring all assets are accounted for and secured. Vulnerability management ensures that the organization stays on top of known vulnerabilities and patches them before they can be exploited.

Together, this triad provides a comprehensive, proactive, and continuous approach to securing cloud environments, ensuring that as the organization’s cloud footprint grows and evolves, its security posture keeps pace.

Defender EASM

Defender EASM continuously discovers and maps your digital attack surface to provide an external view of your online infrastructure. This visibility enables security and IT teams to identify unknowns, prioritize risk, eliminate threats, and extend vulnerability and exposure control beyond the firewall. Attack Surface Insights are generated by leveraging vulnerability and infrastructure data to showcase the key areas of concern for your organization.

Defender EASM is designed to give a comprehensive, real-time view of your organization’s external digital environment. Here’s how it might work in a practical scenario:

Asset Discovery: The EASM solution will first perform an exhaustive inventory of all your organization’s digital assets. This includes not only your own servers, websites, and applications but also assets hosted on third-party services, cloud platforms, and even assets you didn’t know existed. By using techniques similar to those of cyber attackers, such as data gathering from WHOIS databases, DNS records, SSL certificates, and other publicly available information, the EASM solution can discover a comprehensive array of assets associated with your organization.

Risk Assessment: Once the digital assets are identified, the EASM solution performs a risk assessment. This includes vulnerability scanning, checking for misconfigurations, inspecting for sensitive data exposure, etc. The discovered risks are then prioritized based on their severity and potential impact on your business.

Threat Intelligence: Simultaneously, the solution integrates with threat intelligence feeds to understand the latest attacker methods, threat landscapes, and known vulnerabilities. It uses this intelligence to better assess your assets and prioritize risks.

Continuous Monitoring: Defender EASM continuously monitors the assets for changes. If a new asset is added or an existing asset changes in a way that affects the risk profile (such as a new vulnerability), the EASM solution will flag it for attention.

Alerts and Response: When a high-risk issue is identified, the solution sends an alert to your security team. The alert will include information about the risk, such as the affected asset, the nature of the risk, and potential mitigation steps.

Reporting: The solution provides clear, concise reports, dashboards, and visualizations that give an at-a-glance view of the organization’s attack surface, the current risks, and trends over time. These reports can be used to communicate with management, guide decision-making, and demonstrate compliance with security standards.

OUT-IN-IN-OUT

When it comes to monitoring an organization’s external attack surface with Defender EASM (or a similar solution), the terms “outside-in” and “inside-out” refer to two different approaches. Let’s explore each approach:

Outside-In Monitoring: Outside-in monitoring refers to examining the organization’s digital assets and vulnerabilities from the perspective of an external attacker. This approach involves conducting assessments and scans from the outside, simulating the techniques that an attacker would employ. The goal is to identify potential weaknesses and vulnerabilities that could be exploited.

With Defender EASM, outside-in monitoring involves looking at the organization’s external-facing assets such as websites, applications, and network infrastructure. It focuses on identifying vulnerabilities, misconfigurations, open ports, and other security weaknesses that are visible to the outside world. This approach is valuable for understanding how an attacker could potentially breach the organization’s defenses from the outside and provides insights into the organization’s overall attack surface as seen by potential adversaries.

Inside-Out Monitoring: Inside-out monitoring, also known as internal monitoring, involves examining the organization’s assets and vulnerabilities from within the internal network. This approach typically includes monitoring network traffic, analyzing logs, and conducting vulnerability scans from within the organization’s perimeter. The goal is to identify and address potential risks and vulnerabilities that may exist within the internal network.

While Defender EASM primarily focuses on external attack surface management, it may offer some internal monitoring capabilities as well. This can include monitoring internal assets for vulnerabilities, analyzing network traffic for indicators of compromise, or conducting scans to identify misconfigurations or weak points within the internal network. This inside-out perspective provides insights into potential threats and vulnerabilities that may exist within the organization’s internal infrastructure.

Both outside-in and inside-out monitoring approaches are essential for a comprehensive security strategy. By combining these approaches, organizations gain a more holistic view of their overall security posture, identifying vulnerabilities and risk both from external and internal perspectives. This allows for a proactive and well-rounded approach to threat management and mitigation.

A weekly Action with MD EASM

What will be a real-life scenario? A real-life scenario where an organization named “XYZ Corp” decides to implement Defender EASM to enhance its cybersecurity.

1. Week 1 - Initialization: XYZ Corp decides to implement Defender EASM to have a better understanding of their attack surface and manage vulnerabilities more efficiently. The IT security team inputs the organization's known IP ranges, domain names, and other details into the Defender EASM.

2. Week 2 - Asset Discovery: Defender EASM begins its comprehensive asset discovery process. It maps out the company's external-facing digital footprint, including websites, applications, databases, cloud storage instances, network hardware, and IoT devices. Surprisingly, it also discovers several forgotten or unknown digital assets: an old promotional website, several cloud storage buckets from a project completed last year, and an IoT device installed at a remote office.

3. Week 3 - Risk Assessment: After completing asset discovery, Defender EASM performs a risk assessment. It identifies several vulnerabilities and misconfigurations across the company's digital assets. Among them, a severe vulnerability is identified in the old promotional website, and a cloud storage bucket from the previous project is found to be publicly accessible.

4. Week 5 - Threat Intelligence Integration & Continuous Monitoring: Defender EASM integrates with threat intelligence feeds to understand current threat landscapes and attacker methods. It correlates this data with the identified vulnerabilities to prioritize risks. Meanwhile, continuous monitoring discovers a new subdomain related to XYZ Corp appearing online, created by a third-party vendor without the security team's knowledge.

5. Week 6 - Alerts & Response: Defender EASM sends alerts regarding the severe vulnerability and the publicly accessible cloud storage. The security team takes immediate action by taking the old promotional website offline and securing the cloud storage bucket. The new subdomain is also brought to the attention of the security team, who work with the vendor to ensure it's secured.

6. Week 7 - Reporting: Defender EASM generates a comprehensive report showing the discovered assets, identified vulnerabilities, remediation actions taken, and the current status of the organization's external attack surface. The security team presents this report to the management, demonstrating the improvements in their security posture achieved with Defender EASM.

Threat Hunting Approach

Threat hunters need to work with security tools and systems. While some of them provide indicators, others don’t. Threat hunters must create indicators from any system – with Defender EASM, we’ve got tons of indicators, but we can create new ones that can leverage our goals and approach. What can Defender EASM do for threat hunters? Defender EASM can aid threat hunters in several ways:

• Improved Visibility: Defender EASM can provide threat hunters with a comprehensive view of an organization’s external digital environment. This includes known assets such as company websites, databases, and third-party services, but also potentially unknown assets such as forgotten web pages or services, or even assets created by threat actors.
• Asset Profiling and Risk Prioritization: The tool profiles all discovered assets, identifying vulnerabilities and misconfigurations. Threat hunters can then prioritize these risks based on their severity, the criticality of the asset, and the potential impact of a successful attack.
• Integration with Threat Intelligence: Defender EASM can be integrated with threat intelligence feeds to provide updated information about the latest threat actor tactics, techniques, and procedures (TTPs). Threat hunters can use this information to understand what they should be looking for in the organization’s digital environment.
• Continuous Monitoring and Alerting: Defender EASM continually monitors the organization’s digital environment for changes, such as new assets, vulnerabilities, or threat indicators. Threat hunters can react to these alerts quickly, initiating an investigation whenever something suspicious is detected.
• Facilitate Investigations: Defender EASM can provide valuable data points and context during threat-hunting investigations. For example, if a threat hunter is investigating a potential phishing campaign, data from Defender EASM could help confirm if any company-related assets are being used or impersonated.
• Incident Response Support: In case of a confirmed security incident, the information provided by Defender EASM can assist in formulating the incident response. Understanding the affected assets and their vulnerabilities can help threat hunters to mitigate the attack and prevent future occurrences.

IOC’s Scenario

Threat hunting involves proactively searching for indicators of compromise (IOCs) within an organization’s environment to identify potential security threats or incidents. While I cannot provide real-time information on the specific features and capabilities of “Defender EASM” or any proprietary tools, I can provide a general approach to creating IOCs from an EASM solution:

• Leverage EASM Data: Utilize the data collected and monitored by the Defender EASM solution, which may include information about assets, vulnerabilities, network traffic, logs, and other relevant data points.
• Analyze Behavioral Patterns: Analyze the collected data to identify abnormal or suspicious behavioral patterns. Look for anomalies in network traffic, access patterns, user behavior, or system activities that may indicate the presence of an attacker or a compromise.
• Identify Indicators of Compromise: Based on the analysis, extract relevant information that can serve as IOCs. This can include IP addresses, domain names, file hashes, registry keys, patterns in log entries, specific URLs, or other indicators that can potentially indicate malicious activity.
• Leverage Threat Intelligence: Integrate threat intelligence feeds or sources to enrich the IOC creation process. This allows you to cross-reference your findings with known IOCs associated with known threat actors, malware, or attack techniques.
• Define IOC Format: Define the format and structure of your IOCs. Common formats include OpenIOC, STIX (Structured Threat Information Expression), or custom formats that suit your organization’s needs. Ensure that the format chosen is compatible with your threat intelligence platform, security tools, or SIEM (Security Information and Event Management) system.
• Create and Store IOCs: Create IOCs based on the identified indicators and store them in a central repository or IOC management system. Ensure that the IOCs are properly categorized, tagged, and documented for future reference and use.
• Continuous Refinement: As your threat-hunting efforts progress and new IOCs are discovered, refine and update your IOC repository. Stay up-to-date with emerging threats and ensure that your IOCs are relevant and effective in identifying potential security incidents.
• IOC Sharing and Collaboration: Consider sharing your IOCs with relevant communities, trusted partners, or threat intelligence sharing platforms. Collaborate with other organizations to enhance the collective defense against emerging threats.

Remember, the specific process and tools for creating IOCs may vary depending on your organization’s infrastructure, available technologies, and the capabilities of your EASM solution. It’s essential to consult the documentation and resources provided by your specific EASM tool for guidance on creating and utilizing IOCs effectively.

Threat Intelligence Approach

• More Defender EASM Posts
• Defender EASM Overview