Shared Points of Failure How Widespread Vulnerabilities and Overlap Between Organisations Impacts Cyber Resilience

Traditionally, Attack Surface Mapping (ASM) is performed by an organisation seeking to identify its own cyber vulnerabilities, and protect against them. Driven by society’s growing dependence on digital systems, there has been an interest at the government level in the vulnerabilities that affect organisations across a sector, or nationally. External Attack Surface Mapping (EASM) provides a way for government agencies to gather information about the vulnerabilities of organisations at this scale, and this talk covers our ongoing work in partnership with them to identify and visualise widespread vulnerabilities and shared risks. Our research is also investigating how EASM can go beyond the standard lens of vulnerability assessment and can be used to find weaknesses across cyber supply chains, or identify common dependencies between multiple organisations that an adversary could exploit. Detecting and mitigating these weaknesses is therefore crucial for ensuring resilience of the UK’s digital infrastructure, and this talk will present an example highlighting how EASM can be used for this application.