{"id":5111,"date":"2023-04-12T16:17:52","date_gmt":"2023-04-12T20:17:52","guid":{"rendered":"https:\/\/solutionsreview.com\/network-monitoring\/?p=5111"},"modified":"2023-04-12T16:21:01","modified_gmt":"2023-04-12T20:21:01","slug":"easm-what-appsec-and-prodsec-teams-need-to-know","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/","title":{"rendered":"EASM: What AppSec and ProdSec Teams Need to Know"},"content":{"rendered":"

\"External<\/p>\n

Solutions Review\u2019s Expert Insights Series is a collection of contributed articles written by industry experts in enterprise software categories. Rickard Carlsson of Detectify<\/a> offers a primer on External Attack Surface Management (EASM) and what AppSec and ProdSec teams need to know.<\/strong><\/em><\/p>\n

\"ExpertManaging security risks across a complex, evolving external attack surface is becoming increasingly more difficult. While organizations accelerate the pace of digitalization to meet their business goals, they\u2019re inevitably bringing more Internet-facing assets online. Increasing the rate of development to keep up with digitalization expands the attack surface, creating further opportunities for attackers. Unsurprisingly, Gartner identified the expanded attack surface as the top security risk of 2022.<\/p>\n

AppSec and ProdSec teams have historically dealt with this in various ways. DevSecOps, for example, is a popular solution – many organizations feel that the best way to defend their vulnerable assets is to bring security into the development process early on (so-called \u2018Shifting Left\u2019), theoretically catching vulnerabilities before they make it into production.<\/p>\n

The trouble here is that not every vulnerability that makes it into production is present in staging or development. Additionally, application security is not static – a software component may have been considered secure at the time of development, but that may simply have been because the vulnerability hadn\u2019t yet been discovered. No matter how much your organization prioritizes Shifting Left, you won\u2019t catch everything, and you\u2019ll need a plan to prioritize and address the vulnerabilities you miss.<\/p>\n

Furthermore, not every aspect of an organization’s attack surface results from a linear development process. Even if an organization somehow meets the unrealistic goal of zero vulnerabilities in production (hint: they won\u2019t), some assets are acquired through M&A activity, and others may be brought online by certain stakeholders (the marketing team, for example) without alerting the security team. Long story short, it\u2019s highly likely that your organization has unknown online assets that your security team isn\u2019t aware of. And if they don\u2019t know about it, they can\u2019t defend it.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

External Attack Surface Management: What to Know<\/strong><\/h2>\n
\n

What is EASM?<\/strong><\/h3>\n

Rather than handling everything granularly, trying to discover assets manually, and catching vulnerabilities in development, External Attack Surface Management (EASM) takes an outside-in approach. EASM encompasses both the discovery and assessment of an organization’s publicly facing IT assets. A good EASM solution not only identifies every asset but continuously monitors them for any changes. It is in the exposed environment that Initial Access Brokers (IBS) gain the first foothold.<\/p>\n

The intelligent adoption of EASM enables AppSec and ProdSec teams to see their entire external attack surface environment and identify the risk hotspots. Prioritization and fast remediation of the issues that mean the most to the organization are also key components of best-in-class EASM solutions. EASM helps AppSec and ProdSec teams overwhelmed with vulnerability management information transition away from fighting a never-ending fire to holistically managing their organizations’ risks.<\/p>\n

What to Look for in an EASM Solution<\/strong><\/h3>\n

Many EASM products have primarily focused on discovery capabilities, but their testing capabilities amount to little more than vulnerability scanning. EASM tools that use vulnerability management as their base and CPE\/CVE matching often yield high false positive rates. On the other hand, EASM solutions that go beyond CVE matching by leveraging information about the context of assets (for example, a CVE may be present but doesn\u2019t have an associated attack path) effectively reduce noise for security teams and have much higher vulnerability assessment accuracy rates.<\/p>\n

The best EASM solutions do more than just discover assets and scan for vulnerabilities – they continuously test the attack surface with real payloads. A vulnerability scan might uncover a few gaps in the perimeter, but that is not necessarily indicative of how a malicious actor would actually attack you. On the other hand, a real payload-based test, which not only identifies a vulnerability but outlines how an attacker could exploit it, can help you identify and prioritize the issues that actually put your business at risk.<\/p>\n

Continuously Probe Your Attack Surface with EASM<\/strong><\/h3>\n

Chasing vulnerabilities in development and scanning for them in production is all well and good. But to actually manage your external attack surface, you need a solution that tests your entire environment and yields an accurate summary of how and where a malicious actor could exploit the organization.<\/p>\n

Doing this granularly is costly and time-consuming. You\u2019ll never find every single vuln, and you\u2019ll burn through valuable time and resources doing it, which are in short supply today given the economic climate. The best way to protect the business efficiently and cost-effectively is with solutions that not only monitor your entire environment but also help you prioritize so that you aren\u2019t wasting company resources on things that don\u2019t matter. With tight resources and limited resources, you want your security team focused on issues that could actually matter to your organization.<\/p>\n

Suppose you know where all your assets are, which vulnerabilities can actually be exploited, and how to prioritize those that matter most to you. In that case, you’re well on your way to reducing your risk level and effectively managing your attack surface. Continuously testing the entire attack surface with real payloads that identify active vulnerabilities and highlight those that represent the most risk has to be part of the equation. That\u2019s where EASM comes in.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

Solutions Review\u2019s Expert Insights Series is a collection of contributed articles written by industry experts in enterprise software categories. Rickard Carlsson of Detectify offers a primer on External Attack Surface Management (EASM) and what AppSec and ProdSec teams need to know. Managing security risks across a complex, evolving external attack surface is becoming increasingly more […]<\/p>\n","protected":false},"author":619,"featured_media":5112,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1,21],"tags":[],"acf":[],"yoast_head":"\nEASM: What AppSec and ProdSec Teams Need to Know<\/title>\n<meta name=\"description\" content=\"Rickard Carlsson of Detectify offers a primer on External Attack Surface Management (EASM) and what AppSec and ProdSec teams need to know.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"EASM: What AppSec and ProdSec Teams Need to Know\" \/>\n<meta property=\"og:description\" content=\"Rickard Carlsson of Detectify offers a primer on External Attack Surface Management (EASM) and what AppSec and ProdSec teams need to know.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/\" \/>\n<meta property=\"og:site_name\" content=\"Network Monitoring Tools & Performance Software | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2023-04-12T20:17:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-04-12T20:21:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/04\/External-Attack-Surface-Management.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Rickard Carlsson\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rickard Carlsson\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/\",\"name\":\"EASM: What AppSec and ProdSec Teams Need to Know\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/04\/External-Attack-Surface-Management.jpg\",\"datePublished\":\"2023-04-12T20:17:52+00:00\",\"dateModified\":\"2023-04-12T20:21:01+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/ca774a986ab4a4467c0b17bbc3994ed5\"},\"description\":\"Rickard Carlsson of Detectify offers a primer on External Attack Surface Management (EASM) and what AppSec and ProdSec teams need to know.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/04\/External-Attack-Surface-Management.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/04\/External-Attack-Surface-Management.jpg\",\"width\":800,\"height\":400,\"caption\":\"External Attack Surface Management\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/network-monitoring\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"EASM: What AppSec and ProdSec Teams Need to Know\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/\",\"name\":\"Network Monitoring Tools & Performance Software | Solutions Review\",\"description\":\"Evaluating Enterprise NPM Software, Network Observability & Packet Analysis Tools.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/ca774a986ab4a4467c0b17bbc3994ed5\",\"name\":\"Rickard Carlsson\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/39120db08663a8bdfd6b4c4359129961?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/39120db08663a8bdfd6b4c4359129961?s=96&d=mm&r=g\",\"caption\":\"Rickard Carlsson\"},\"description\":\"A tech nerd that went from applied physics\/math to a management consultant at McKinsey to co-founding Detectify, Rickard lives on the border between tech and commercial dialogues. As one of the co-founders, Rickard has grown Detectify from a group of ethical hackers with an idea on how to make the internet safer, to an international industry challenger that's 130+ people strong. Rickard has a background in tech and management consulting and has lived and worked in Sweden, India, and the US.\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/author\/rcarlsson\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"EASM: What AppSec and ProdSec Teams Need to Know","description":"Rickard Carlsson of Detectify offers a primer on External Attack Surface Management (EASM) and what AppSec and ProdSec teams need to know.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/","og_locale":"en_US","og_type":"article","og_title":"EASM: What AppSec and ProdSec Teams Need to Know","og_description":"Rickard Carlsson of Detectify offers a primer on External Attack Surface Management (EASM) and what AppSec and ProdSec teams need to know.","og_url":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/","og_site_name":"Network Monitoring Tools & Performance Software | Solutions Review","article_published_time":"2023-04-12T20:17:52+00:00","article_modified_time":"2023-04-12T20:21:01+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/04\/External-Attack-Surface-Management.jpg","type":"image\/jpeg"}],"author":"Rickard Carlsson","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rickard Carlsson","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/","url":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/","name":"EASM: What AppSec and ProdSec Teams Need to Know","isPartOf":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/04\/External-Attack-Surface-Management.jpg","datePublished":"2023-04-12T20:17:52+00:00","dateModified":"2023-04-12T20:21:01+00:00","author":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/ca774a986ab4a4467c0b17bbc3994ed5"},"description":"Rickard Carlsson of Detectify offers a primer on External Attack Surface Management (EASM) and what AppSec and ProdSec teams need to know.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#primaryimage","url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/04\/External-Attack-Surface-Management.jpg","contentUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2023\/04\/External-Attack-Surface-Management.jpg","width":800,"height":400,"caption":"External Attack Surface Management"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/network-monitoring\/easm-what-appsec-and-prodsec-teams-need-to-know\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/network-monitoring\/"},{"@type":"ListItem","position":2,"name":"EASM: What AppSec and ProdSec Teams Need to Know"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website","url":"https:\/\/solutionsreview.com\/network-monitoring\/","name":"Network Monitoring Tools & Performance Software | Solutions Review","description":"Evaluating Enterprise NPM Software, Network Observability & Packet Analysis Tools.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/ca774a986ab4a4467c0b17bbc3994ed5","name":"Rickard Carlsson","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/39120db08663a8bdfd6b4c4359129961?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/39120db08663a8bdfd6b4c4359129961?s=96&d=mm&r=g","caption":"Rickard Carlsson"},"description":"A tech nerd that went from applied physics\/math to a management consultant at McKinsey to co-founding Detectify, Rickard lives on the border between tech and commercial dialogues. As one of the co-founders, Rickard has grown Detectify from a group of ethical hackers with an idea on how to make the internet safer, to an international industry challenger that's 130+ people strong. Rickard has a background in tech and management consulting and has lived and worked in Sweden, India, and the US.","url":"https:\/\/solutionsreview.com\/network-monitoring\/author\/rcarlsson\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/5111"}],"collection":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/users\/619"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/comments?post=5111"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/5111\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media\/5112"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media?parent=5111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/categories?post=5111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/tags?post=5111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}