Attack Surface Management for Indian SMBs: A Practical Guide

Attack surface management (ASM) is the continuous process of discovering, inventorying, and securing every internet-facing asset your organisation owns — domains, subdomains, IPs, open ports, cloud buckets, APIs, admin panels, and forgotten staging servers. For Indian SMBs, the attack surface grows silently with every new hire, SaaS subscription, and cloud deployment. Most businesses have no idea how large it already is. This guide explains what ASM is, why it matters more than an annual pentest, and how to build a low-cost, continuous ASM routine that keeps your exposure under control.

What Is an Attack Surface?

Your attack surface is the complete set of points where an attacker can attempt to enter, extract data from, or disrupt your systems. It includes everything reachable from the public internet — whether you know about it or not.

A practical inventory for an Indian SMB typically spans:

1. Domains and subdomains — your primary domain, marketing microsites, legacy subdomains like staging.yourcompany.com or old.yourcompany.com
2. IP addresses and open ports — any server, VPS, or cloud instance with a public IP; ports 22 (SSH), 3389 (RDP), 3306 (MySQL), 27017 (MongoDB)
3. Cloud storage buckets — AWS S3, Google Cloud Storage, Azure Blob with misconfigured public access
4. Web applications and APIs — customer-facing portals, internal dashboards accidentally exposed to the internet, REST or GraphQL endpoints without authentication
5. Admin and management panels — phpMyAdmin, Grafana, Jenkins, cPanel, WHM, Kibana
6. Third-party SaaS integrations — services that hold your customer data or have API-level access to your systems
7. Expired or orphaned certificates — domains with lapsed SSL that still resolve and serve traffic

External ASM vs Internal Asset Management

These two disciplines are related but distinct.

External Attack Surface Management (EASM) focuses on assets reachable from the public internet — the attacker's view. It answers: what can an adversary see and probe from outside? EASM tools enumerate DNS records, scan IP ranges, crawl certificate transparency logs, and discover exposed services without requiring any internal access.

Internal asset management (also called IT asset management or ITAM) focuses on what exists inside your network — endpoints, servers, software versions, patch levels. It answers: what do we own and is it up to date?

For most Indian SMBs, the external view is the more urgent starting point. Internal assets behind a firewall still matter, but an attacker starts with what is publicly reachable. EASM tells you exactly what they can see before they get in.

The Discovery Problem: Why Your Attack Surface Grows Unnoticed

Three dynamics consistently expand SMB attack surfaces beyond what security teams track:

Shadow IT

When teams adopt SaaS tools or spin up cloud compute without central oversight, those assets enter the attack surface unannounced. A freelancer adds a campaign subdomain. A developer leaves a test API running on an EC2 instance. A contractor never closes a remote access session. None of these appear in any official inventory.

Abandoned Projects and Legacy Systems

Products deprecated but never decommissioned are a persistent risk — the old customer portal, the pre-migration database server, the staging environment that was supposed to be torn down six months ago. Attackers scan specifically for unmonitored, unpatched systems.

Mergers, Acquisitions, and Vendor Onboarding

When an SMB acquires a smaller company or onboards a major vendor, it inherits that entity's attack surface — including unknown and unpatched assets. Due diligence rarely includes an EASM scan, so the merged entity carries compounded exposure from day one.

The ASM Lifecycle

ASM is not a one-time task. It is a loop that runs continuously.

graph TD
    A[Discover All Assets] --> B[Build Inventory]
    B --> C[Prioritize by Risk]
    C --> D[Remediate Findings]
    D --> E[Continuously Monitor]
    E --> A
    F[Shadow IT and Unknown Assets]:::danger --> A
    G[New Deployments and SaaS Signups]:::danger --> A

    style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style C fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style E fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style G fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0

Each phase has a concrete output:

1. Discover — automated enumeration of externally reachable assets: DNS brute-force, certificate transparency log mining, IP range and port scanning, web crawling
2. Inventory — a structured record of every discovered asset: type, owner, technology stack, last seen, risk score
3. Prioritize — rank by exploitability, exposure, and business criticality; a public S3 bucket with customer PII outranks an internal monitoring tool on a restricted port
4. Remediate — close unused ports, revoke public bucket ACLs, patch exposed panels, rotate leaked credentials, retire dead subdomains
5. Monitor — scheduled re-scanning so new assets and new vulnerabilities surface immediately rather than waiting for the next annual review

Common Exposures Indian SMBs Leave Open

Based on CERT-In advisories and public threat intelligence, these are the exposures most frequently found on Indian SMB attack surfaces:

Breakdown of a Typical SMB External Attack Surface

Web applications and subdomains typically dominate by count; exposed cloud services and APIs carry disproportionately high risk despite lower numbers.

pie title SMB External Attack Surface by Asset Type
    "Web Apps and Admin Panels" : 35
    "Subdomains and DNS Records" : 28
    "Exposed Services and Open Ports" : 18
    "Cloud Storage and APIs" : 12
    "Third-Party SaaS Integrations" : 7

This distribution is qualitative — drawn from common EASM scan patterns — not a precise industry census. Your own organisation's breakdown will differ based on how cloud-native or SaaS-heavy your stack is.

Continuous ASM vs the Annual Pentest

A penetration test is point-in-time: a skilled team probes your systems on a specific date, produces a report, and leaves. By the time half those findings are remediated, new assets may have been deployed and new vulnerabilities disclosed.

Continuous ASM does not replace pentesting — it complements it. NIST SP 800-137 recommends ongoing monitoring as the foundation of any information security programme, with formal assessments layered on top. CISA's Cybersecurity Performance Goals similarly treat asset inventory and continuous vulnerability scanning as baseline controls before more advanced measures.

The practical difference:

1. A pentest tells you what was wrong on the day of the test
2. Continuous ASM tells you what is wrong right now, every day
3. Combining both gives you depth-tested findings plus real-time exposure tracking

Building a Low-Cost ASM Routine for Indian SMBs

A disciplined routine built on available tooling can give meaningful coverage without an enterprise-grade EASM platform.

Step 1 — Enumerate Your DNS

Use subfinder, amass, or certificate transparency tools to enumerate all subdomains of your primary domain. Many organisations discover subdomains they did not know were still resolving.

Step 2 — Scan for Open Ports and Services

Run a scheduled scan (fortnightly) against your known IP ranges and cloud assets. Flag any port absent from the previous scan — new open ports are immediate investigation triggers.

Step 3 — Check Cloud Storage Permissions

For every S3, GCP, or Azure Blob container, audit access control lists periodically. Any bucket that allows public listing or unauthenticated reads is a P0 finding.

Step 4 — Monitor Certificate Transparency Logs

CT logs are public — any new certificate for a subdomain of your domain appears within minutes. Monitoring via crt.sh gives early warning of subdomains you did not authorise.

Step 5 — Inventory Third-Party Integrations

Quarterly, audit SaaS tools and services with access to your data or systems. Revoke inactive integrations and rotate API keys where the original owner has left.

Step 6 — Automate and Alert

New open ports, new subdomains, and new public buckets should trigger immediate notifications to your security owner. Without alerting, scheduled scans are just periodic checklists.

ASM Checklist for Indian SMBs

For deeper reading, the CISA Cyber Essentials guide is at https://www.cisa.gov/cyber-essentials and NIST SP 800-137 on continuous monitoring at https://csrc.nist.gov/pubs/sp/800/137/final.