Internet exposure is a property that changes
Whether something is reachable from the internet is not a fixed attribute. It changes without anybody deciding to change it.
A firewall rule for a project, a load balancer reconfigured, a cloud setting altered, a supplier's change. Something that was internal on Monday can be public on Thursday with no corresponding ticket. Which is why exposure needs continuous checking rather than a review at design time.
More on Attack surface management
- The Internet sees what you expose, not what your CMDB remembersCounted three. Answering six
- A new subdomain can create a new perimeterThe fence just got longer
- Shadow IT becomes shadow attack surfaceDoors around the back
- Acquisitions merge attack surfaces before inventoriesThe wire arrives first
- A forgotten test system can be a production entry pointThe shed is still joined to the house
- Third-party hosted assets still carry your nameTheir building, your name over the door