Connectorless Assessment
Connectorless assessment in cybersecurity refers to evaluating an organization's security posture by examining its externally visible assets and behaviors without requiring direct connections, agents, or credentials to its internal systems or networks.
Here's a detailed explanation:
External Focus: Connectorless assessments concentrate on what an attacker can observe and interact with from the outside. This includes websites, public-facing applications, email servers, and other internet-accessible resources.
No Internal Access: The key characteristic is the absence of any need to install software agents within the target network, use API keys, or possess login credentials. The assessment relies solely on publicly available information and external interactions.
Passive and Active Techniques:
Passive techniques involve gathering publicly accessible information, such as DNS records, WHOIS data, and website content.
Active techniques involve interacting with external-facing systems, such as scanning for open ports, analyzing website responses, and attempting to exploit known vulnerabilities.
Real-World Simulation: This approach mimics how an actual attacker would begin their reconnaissance and attack planning, providing a realistic view of an organization's external attack surface.
Attack Surface Mapping: Connectorless assessments help map out the organization's external attack surface, identifying potential entry points for attackers.
Vulnerability Identification: These assessments aim to discover vulnerabilities exposed to the Internet, such as outdated software, misconfigurations, and weak security practices.
Here's how ThreatNG's capabilities align with and support connectorless assessments:
ThreatNG's core strength is its ability to perform "purely external unauthenticated discovery using no connectors".
This is the foundation of connectorless assessments, emphasizing gathering information about the target organization's external footprint without needing access to internal systems.
ThreatNG uses its Domain Intelligence to analyze DNS records, subdomains, and other publicly available data, exemplifying connectorless discovery techniques.
ThreatNG's assessment modules focus on evaluating the organization's security posture from an external perspective, aligning with the principles of connectorless assessment.
It calculates various susceptibility ratings based on externally observable information.
Examples:
Web Application Hijack Susceptibility: This assessment analyzes externally accessible parts of web applications to identify potential entry points for attackers. It demonstrates a connectorless approach by not requiring access to the web server's internals.
Subdomain Takeover Susceptibility: ThreatNG evaluates subdomain takeover susceptibility by analyzing publicly available information, such as DNS records and SSL certificate statuses.
Mobile App Exposure: ThreatNG discovers mobile apps in marketplaces and analyzes them for exposed credentials and security vulnerabilities, performing an assessment based on publicly available app information.
3. Reporting
ThreatNG's reporting capabilities deliver findings based on connectorless assessments in a clear and actionable format.
The reports provide insights into external vulnerabilities and risks, enabling organizations to understand their security posture from an attacker's viewpoint.
ThreatNG's continuous monitoring of the external attack surface aligns with the ongoing nature of connectorless assessments.
By continuously monitoring for changes and new exposures, ThreatNG helps organizations maintain an up-to-date understanding of their external security posture without requiring persistent internal access.
ThreatNG's investigation modules provide detailed information gathered through connectorless techniques to help security teams understand and address external vulnerabilities.
Examples:
Domain Intelligence: This module allows for the in-depth investigation of domain-related information obtained through external queries, such as DNS records and WHOIS data.
Search Engine Exploitation: This module helps users investigate an organization’s susceptibility to exposing information via search engines, which is a purely external analysis.
ThreatNG's intelligence repositories contain information relevant to external threats and vulnerabilities, supporting connectorless assessments by providing context for externally observed findings.
For example, the dark web presence repository provides information on compromised credentials and ransomware events, which can help organizations assess their external risk profile.
7. Working with Complementary Solutions
ThreatNG's connectorless assessment data can enhance other security tools.
For example, ThreatNG's external vulnerability data can be fed into a SIEM to correlate external attack surface findings with internal security events, providing a more comprehensive security picture.
ThreatNG's external assessment data can complement internal vulnerability scanning by providing a contrasting external viewpoint.
In summary, discovery, assessment, reporting, continuous monitoring, and investigation modules all operate on analyzing an organization's security posture from the outside without requiring access to internal systems.
