NCSC seeks feedback on external attack surface management guidance

Individuals who evaluate, select or implement external attack surface management solutions are being asked by the UK National Cyber Security Centre to provide input to inform its guidance.

As part of its ACD 2.0 research, the NCSC worked with organisations that use external attack surface management (EASM) and exposure management tools to understand how teams assess findings, decide on priorities and react to possible risks. The NCSC’s ongoing study looks at the first phase of external attack surface management, focusing on how organisations determine their needs, compare choices and pick the tools or services that suit them best.

The NCSC is asking for input from individuals who evaluate cyber security products, assist with cyber risk management, sway investment choices, manage buying or supplier selection, or work in areas such as cyber security governance, assurance and strategic leadership. It especially wants to hear from people who have recently taken part in decisions about external attack surface management, exposure management or related security functions, such as those who define requirements, weigh alternatives, build business cases, affect funding or buying, choose vendors or influence how their organisation handles external attack surface risk.

Taking part in the NCSC’s study is optional, and any details shared will remain confidential. Those interested can sign up using a form run by Optimal Workshop that should require no more than five minutes to finish. The registration form bears the title ‘NCSC: Registration of interest for ACD 2.0 research’.

The NCSC says that the experiences of participants could assist it in creating improved guidance and services for organisations that handle external attack surface risk. It anticipates that the feedback gathered will help form enhanced guidance and services for organisations dealing with external attack surface risk.

Ollie Whitehouse, who serves as the NCSC’s Chief Technology Officer, explained that External Attack Surface Management aids organisations in grasping their internet-facing exposure, noting that although it seems like a solved issue, it is actually more complex. “helping organisations understand their internet-facing exposure – a problem that feels like it should be solved by now but is more nuanced than it appears.”

Basic methods of external attack surface management—including DNS enumeration, certificate transparency monitoring, port scanning, service fingerprinting, cloud posture checks and vulnerability scanning of identified assets—are firmly established and commonly found in commercial products. Gartner first defined the EASM market segment in 2021, and it is now consolidating through deals like Google’s acquisition of Mandiant, IBM’s purchase of Randori, and Microsoft’s buyout of RiskIQ, showing the market has moved past its initial phase.

In 2022, CISA’s Binding Operational Directive 23-01 required US federal agencies to gain asset visibility, indicating that this capability is now seen as a basic requirement rather than an advanced feature. Looking at the control framework, NIST 800-53 offers strong support for external attack surface management through controls CM-08, RA-05, CA-07 and SC-20, which cover the essential needs.

The NCSC’s ACD 2.0 project focuses on emerging aspects of external attack surface management where tools, methods and day-to-day use are still changing, such as cloud‑based temporary surfaces, finding application programming interfaces, determining who owns assets, nationwide EASM, supply‑chain related surfaces and measurement approaches. Temporary cloud elements like containers, serverless functions and auto‑scaling groups produce a short‑lived attack surface lasting only minutes or hours, while regular interval‑based scanning overlooks 20-40% of the external surface in organisations that rely heavily on cloud infrastructure.

Some suppliers of external attack surface management tools are developing event‑driven discovery that draws on cloud provider logs such as CloudTrail, Azure Activity Log and GCP Audit Log, but this approach has not yet become a common practice. Discovering application programming interfaces from outside the network is challenging since APIs do not publish their presence through DNS, certificate transparency or standard ports; the main techniques—crawling networks, analysing traffic and looking for exposed Swagger or OpenAPI specifications—provide only partial visibility, and APIs that are unintentionally made public due to incorrectly configured API gateways represent an increasing source of breaches.

In big companies, the process of assigning ownership to assets that are found but not claimed takes up 40% to 60% of the work involved in external attack surface management, because organisations look into items like leftover merger and acquisition components, unapproved internal technology, services hosted by partners and test systems that have not been shut down. Methods that use graphs to connect assets with identity information, billing records and configuration management databases show potential for solving attribution issues, but they are still in an early stage.

Applying external attack surface management across an entire nation’s essential infrastructure introduces distinct difficulties, such as crossing legal borders, managing permission procedures, handling false positives among millions of items, coordinating alerts across thousands of groups with different levels of readiness, and dealing with the political risk of a state body revealing the systems of private firms. The NCSC’s earlier ACD 1.0 initiative showed usefulness through tools such as Web Check and Mail Check; its ACD 2.0 effort expands the scope to complete attack surface management and calls for study into how to scale it, automate it and govern it, since no commercial offering currently serves an entire country.

No universally accepted way to measure external attack surface management exists; suggested indicators consist of the total number of assets found over time, the average duration to locate new assets, the average time to fix problems according to their seriousness, the proportion of shadow IT and the trend in reducing the attack surface, yet comparing these figures between organisations is difficult because the range and techniques of discovery differ. The NCSC’s SP‑046 framework for external attack surface management links twenty‑eight controls from NIST 800-53, grouped into eleven families, to the EASM function; it addresses where data gathering occurs, how the system operates, and how fixes are implemented, and it highlights a section on developing areas that points out the six topics mentioned earlier.

The NCSC’s ACD 2.0 programme aims to create ways to expand, automate and govern national‑level external attack surface management that are currently missing from commercial products. The NCSC is looking to align future iterations of its Cyber Assessment Framework with the forthcoming Cyber Security and Resilience Bill, which updates the NIS Regulations and should become law later this year.

Businesses that employ external attack surface management examine the results, order their actions by importance and deal with possible threats as a regular part of their process. The NCSC states that almost every United Kingdom cyber security regulator and the GovAssure programme make use of the Cyber Assessment Framework.