EASM for ISO 27001
External Attack Surface Management (EASM) in cybersecurity is a continuous, outside-in process for discovering, inventorying, classifying, and prioritizing an organization's internet-facing assets and the risks associated with them. It focuses on the perspective of an unauthenticated attacker to identify and address vulnerabilities and exposures that are often unknown or unmanaged by internal security teams.
When considered against the ISO 27001 standard for an Information Security Management System (ISMS), EASM is a critical capability that supports several key controls:
Configuration Management (A.8.9) and Technical Vulnerability Management (A.8.2): EASM directly supports these controls by identifying misconfigurations and vulnerabilities on internet-facing assets, including open ports, missing security headers in web applications, and unpatched software. It ensures that technical weaknesses exposed to the public internet are continuously assessed and remediated.
Secure System Architecture (A.8.27): By revealing the actual external footprint—including shadow IT, forgotten subdomains, or misconfigured cloud storage—EASM validates whether the organization's systems are securely designed and engineered to minimize the attack surface, as required by this control.
Network Security (A.8.20): EASM serves as a proactive monitor of the network perimeter, flagging issues such as exposed VPN endpoints, unprotected public IP addresses, or the absence of crucial email security records (such as SPF and DMARC), which are fundamental to network defense.
Information Classification and Access Control (A.8.2 & A.5.15): The discovery of sensitive information exposure, such as data in open cloud buckets or credentials in public code repositories, directly addresses the need to classify sensitive data and enforce strict access controls, even on external platforms.
Threat Intelligence (A.5.7) and Incident Management (A.16.1): EASM contributes to threat intelligence by proactively identifying potential attack vectors, such as lookalike domain name permutations used for phishing, and provides early warning signs that feed into the incident management process.
In essence, EASM is the continuous external visibility component of an ISO 27001-compliant ISMS, ensuring that the defined security controls are effective against real-world external threats and exposures.
The ThreatNG platform is specifically designed to address external risk challenges, directly supporting and operationalizing the core requirements of ISO 27001 by providing an attacker's view of the environment.
External Discovery and Continuous Monitoring
ThreatNG performs purely external, unauthenticated discovery to build a complete inventory of an organization's digital footprint. This initial step is foundational, as you cannot protect what you do not know about. This discovery is not a one-time event; the platform continuously monitors the external attack surface, digital risk, and security ratings for all organizations. This continuous process ensures that as new assets are deployed or new risks emerge—such as a developer spinning up an unsecure cloud resource—ThreatNG identifies them promptly.
External Assessment and Security Ratings
ThreatNG uses the data gathered during discovery to perform detailed external assessments, resulting in Security Ratings (A–F) across various risk categories. This helps prioritize risk and aligns directly with ISO 27001's focus on risk assessment and treatment.
Examples of these assessments include:
Web Application Hijack Susceptibility (A–F): This rating analyzes the presence or absence of key security headers on subdomains. For instance, the lack of a Content-Security-Policy (CSP) header is specifically checked to mitigate risks like cross-site scripting (XSS), data injection, and unauthorized content execution. The missing HTTP Strict-Transport-Security (HSTS) header and X-Frame-Options header are also assessed.
Subdomain Takeover Susceptibility (A–F): ThreatNG checks for "dangling DNS" by identifying CNAME records pointing to inactive or unclaimed third-party services. For example, if a subdomain's CNAME record points to an Amazon S3 bucket, Elastic Beanstalk service, or a defunct Heroku application that the organization no longer owns, the platform validates this inactive state and prioritizes the risk.
Data Leak Susceptibility (A–F): This rating is derived from the identification of exposed cloud buckets (Cloud Exposure) and sensitive data, such as compromised credentials. For example, a misconfigured AWS, Microsoft Azure, or Google Cloud Platform storage bucket could be found openly exposing confidential files, directly contributing to this rating.
Breach & Ransomware Susceptibility (A–F): This rating focuses on high-risk technical findings, such as exposed ports (e.g., SSH, RDP, database authentication ports), the presence of Private IPs in public records, and externally identified vulnerabilities on subdomains. It also incorporates intelligence on Ransomware Events and Compromised Credentials.
Investigation Modules
ThreatNG provides several detailed investigation modules to deep dive into specific risk vectors.
Examples of the data uncovered by these modules include:
Subdomain Intelligence: This module is central to technical risk discovery. It performs detailed analysis, including:
Content Identification to find exposed Admin Pages, APIs, Development Environments, and VPNs.
Ports scanning to identify open services on standard and custom ports, such as industrial control systems (ICS) or exposed databases (e.g., SQL Server, MongoDB).
WAF Discovery to identify the presence and vendor of Web Application Firewalls down to the subdomain level (e.g., Cloudflare WAF, Akamai).
Sensitive Code Exposure: This module searches public code repositories for exposed Code Secrets. This includes finding leaked credentials like Stripe API keys, Google Cloud API keys, AWS Access Key IDs, or SSH private keys accidentally committed to public platforms like GitHub.
Domain Intelligence: This module includes Domain Name Permutations to uncover both taken and available lookalike domains. It can also flag those taken permutations that have an associated Mail Record (MX), which indicates a high-risk likelihood for phishing and business email compromise (BEC) attacks.
Intelligence Repositories
ThreatNG maintains continuously updated intelligence repositories (branded as DarCache) that enrich its findings and provide crucial context for ISO 27001's threat intelligence requirements.
Dark Web (DarCache Dark Web) and Compromised Credentials (DarCache Rupture): These track organizational mentions and leaked login credentials (emails and passwords), which is highly relevant to A.5.17 Authentication Information.
Vulnerabilities (DarCache Vulnerability): This repository proactively manages external risks by integrating data from the NVD (severity), EPSS (likelihood of exploitation), and KEV (actively exploited in the wild). This directly supports A.8.2 Technical Vulnerability Management by prioritizing threats based on real-world exploitability.
Ransomware Groups and Activities (DarCache Ransomware): This tracks over 70 ransomware gangs and their activities, providing valuable intelligence for A.16.1 Incident Management and A.17.1 Information security continuity planning.
Reporting
ThreatNG generates various reports that translate technical findings into actionable business context for management and technical teams. For governance and compliance, it provides reports like the External GRC Assessment Mappings which directly correlate technical findings to standards like ISO 27001, PCI DSS, and NIST CSF. This allows management to understand security posture in terms of compliance obligations. The Executive Report and Prioritized Technical Reports ensure that security efforts are effectively communicated and resource allocation is focused on the most critical risks.
Complementary Solutions
ThreatNG's strength lies in its external, unauthenticated perspective, which perfectly complements internal security tools.
Vulnerability Management Solutions (VMS): A typical VMS identifies vulnerabilities inside the network. ThreatNG identifies the same or related vulnerabilities on the external attack surface (e.g., critical vulnerabilities found on publicly exposed subdomains). By linking these external findings to the VMS, an organization can prioritize patching internet-exposed assets over internally protected systems, accelerating remediation efforts by focusing on the most likely entry points for attackers.
Security Information and Event Management (SIEM) / Security Orchestration, Automation, and Response (SOAR): ThreatNG provides high-certainty, Legal-Grade Attribution of external risks. This context can be fed directly into a SOAR platform. For example, if ThreatNG discovers a compromised email associated with an executive (an external discovery), the SOAR platform can automatically trigger a workflow to force a password reset and enable Multi-Factor Authentication (MFA) for that specific user within the Identity and Access Management (IAM) system, achieving immediate risk mitigation based on irrefutable external evidence.
Governance, Risk, and Compliance (GRC) Platforms: ThreatNG's External GRC Assessment Mappings for ISO 27001 can be integrated with an organization’s internal GRC platform. When ThreatNG identifies a control failure—for instance, missing clientDeleteProhibited on a critical domain (a misconfiguration that directly affects A.8.1 Responsibility for assets and A.8.9 Configuration management)—the GRC platform can automatically update the domain asset's risk score and create a high-priority audit finding for the responsible asset owner.
