Attack Surface Management

What is your Attack Surface?

The National Institute of Standards and Technology (NIST) defines the attack surface as, “The set of points on the boundary of a system, a system element, or an environment [the assets] where an attacker can try to enter, cause an effect on, or extract data from, that system, system element, or environment.”

Intuitively, you probably understand your “attack surface” as the perimeter of your corporate network and the points of entry that a hacker might use to breach your security and steal or ransom critical data. The good news is that you’re mostly correct. The bad news is that your true attack surface is likely much broader and more exposed than you might think.

In reality, your attack surface includes:

Your team. Consider the number of employees who have access to critical data, the information they share on social media, the passwords they use (and reuse), and their natural inclination to be helpful.
Your vendors. The upstream and downstream companies in your supply and service chains may also expose you to attack.
Your devices. In addition to phones and laptops, the Internet of Things (IoT) – including any connected device – can be an open window into your network.
Your data. Information stored in the cloud or on local devices represents an increasingly larger share of your company’s value.

Complicating cybersecurity even further is the vast array of increasingly sophisticated tools that are readily available to hackers – along with the escalation of cyberwarfare to include attacks on our infrastructure and economy itself.

Managing Risks in an Evolving Threat Landscape

At Raxis, we get it. Cybersecurity can seem like a never-ending battle, and it’s easy to retreat into safe harbors and big-box, checkbox solutions. With your reputation and your revenue at stake, however, it makes sense to bring on a partner who understands what you’re up against and who can help you focus your resources where they are most effective in terms of both cost and security.

This is where Raxis shines. We see security differently because our team includes some of the most skilled and experienced certified hackers in the world. We have former IT and database administrators, system admins, software developers and architects, embedded device and IoT experts, as well as corporate cybersecurity leaders, internal red team and blue team members, and even fireworks specialists and improv performers.

Scanning isn’t Seeing: New technology is not enough

Much of the conversation around ASM involves staying ahead in a technological arms race. Companies, including Raxis, are turning more to automation to stay ahead of the threats. But there is a tremendous difference between set-it-and-forget-it tech and integrated systems that extend the capabilities of human experts.

Raxis Penetration Testing as a Service (PTaaS) blends the speed and reach of automation with the skills and experience of our expert team members. Technology can surface a potential issue, but it takes a skilled professional to understand its true significance.

Paths, not just Points: Raxis breaks the chains

Corporate security isn’t capture-the-flag. Hackers don’t stop just because they’ve successfully penetrated your network. Whether they’re motivated by greed, activism, curiosity, or military objectives, they won’t stop until they have stolen, copied, or encrypted your data, or otherwise disrupted your operations.

When Raxis spots a potential problem, we attempt an exploit. In many cases, we hit a dead end – saving your team the trouble of investigating a non-issue. However, if we get in, we follow the path as far as it will take us to understand the real risk it represents. Why? Because in the real world, hackers create chained attacks, sometimes using a series of minor vulnerabilities to execute a catastrophic breach.

What other automated services might flag as unrelated, low-level threats, Raxis engineers recognize as potential links that can be connected to enable unauthorized access to your network.

Raxis Attack Surface Management

Unrivaled Penetration Testing

While no amount of security guarantees you will not be breached, Raxis can certainly help you drive down the severity of a security compromise by identifying areas to improve your response to an attack. The Raxis Pentest Team uses the same techniques that today’s malicious hackers use, including detection evasion, recent exploits, social engineering, and chained attacks. This is not a vulnerability scan, as our pentesters will breach your perimeter, pivot to other opportunities, exfiltrate critical data, obtain and crack password hashes, and demonstrate how a foothold would be maintained.

Advanced Social Engineering

Security technology will always fail the test of good intentions. Social engineering is a powerful attack vector that targets the greatest weakness in any organization: its people. Whether it's through phishing, smishing, vishing, whaling, direct interaction, or other pretext, a well-executed social engineering test can manipulate your employees to reveal sensitive data in ways you never imagined.

Security Framework Analysis

A robust enterprise solution that gets down to brass tacks, we map your policies and procedures' maturity across industry standard security controls. An extensive interview and documentation process leaves no stone unturned. Your greatest strengths, weaknesses, and all points between are spelled out in a detailed gap analysis and roadmap. We work with common security controls, such as CIS 18, NIST, and ISO 27001. Interested in using another security framework? Our team is ready to scope the analysis to fit your needs no matter the framework that best fits your industry.

Red Team Assessment

In most of our Red Team assessments, physical security is deemed in scope to gain a full view of every potential avenue of attack. We test physical security to ensure that intruders can't gain access to systems that may be protected by physical access controls. This often includes badge readers, wireless networks, electronic door locks, and network-connected cameras. While we will operate within your parameters, it always works out better for you if we are not limited in scope.