I’ve spent last year creating asset inventories of the world's largest organizations (via Bit Discovery). It’s absolutely crazy to see just how many assets they have connected to the Internet — many have hundreds of thousands.
You can’t secure what you don’t know you own.
You can’t secure what you don’t know you own.
As it turns out, creating an inventory of internet-connected assets for an organization is easily the hardest engineering challenge I’ve ever worked on in my career.
An organization’s internet-connected devices may exist on many different IP-ranges, domain names, hosted services, labelled under a variety of brands or departments, managed by subsidiaries and partners, and may come and go without warning. (Very hard problem)
Seemingly simple asset inventory questions the vasty majority of large ORGs are unable to answer, but all should. List of:
1) Websites w/ expired TLS certs.
2) All dns servers
3) All domains and sub-domains
4) Everything in 'the cloud'
5) Everything using Wordpress, Joomla, etc
1) Websites w/ expired TLS certs.
2) All dns servers
3) All domains and sub-domains
4) Everything in 'the cloud'
5) Everything using Wordpress, Joomla, etc
