Manage Your Attack Surface on a Budget

The talk opens with the problem of knowing what you are defending. Organizations have data centers, headquarters and satellite sites, and a single misconfigured host can be found by attackers using internet scanners. The speakers cite Verizon breach report findings on misconfigurations and old internet-facing vulnerabilities as evidence that exposure is a common cause of incidents.

The middle covers Scout, a homegrown tool for external attack surface management. It works in stages: connect registrars and cloud accounts, enumerate IPs and DNS names, query internet search data sources, run port and banner checks, establish a baseline with the security operations team, then send alerts to chat or ticketing. The team said the largest hurdle was building the baseline, and moving scanning work to serverless cloud services cut scan time from about 28 days to roughly 12 hours. A second component, Scout Internal, looks for sensitive data copied to developer workstations and other sites, using regex-based PII detection, and it faced access, new database type and latency challenges.

The closing portion compares the homegrown approach with commercial products: it is customizable but needs senior engineers and integration work. Practical advice includes starting from accounting records to find services in use, running the scanner from a cloud instance, and treating IoT and SBOM aggregation as next steps. Privacy laws across regions shaped how scanning was scoped by country.