API Security Through External Attack Surface Management

Phillip Wylie argues that organizations cannot protect assets they do not know exist. Penetration tests done once or twice a year leave long gaps, while attackers scan the internet constantly. He defines external attack surface management as the ongoing practice of finding and tracking everything exposed to the internet, and he points out that compliance-driven testing often misses environments outside its defined scope.

The middle of the talk covers the practical side. Discovery starts with IP ranges, autonomous system lookups, regional registry data, and subdomain enumeration, followed by reconnaissance using scanners and open-source sources such as Shodan and company acquisition records. From there the focus narrows to locating web services and API endpoints with enumeration tools, then testing them with fuzzers, intercepting proxies, and API-focused scanners. He also flags risky exposures such as RDP, SMB, clear-text FTP and Telnet, and internal APIs that could leak past the perimeter.

He closes with recommendations: maintain an accurate, continuously updated asset inventory, retest after fixes instead of accepting risk, automate repetitive checks, and review open-source components as part of API testing. The takeaway for a practitioner is a repeatable process for finding forgotten or misconfigured exposed APIs before attackers do.