How a Company's Footprint is Mapped in the Bitsight Platform

The Bitsight inventory consists of companies, clients, country-industries, etc. that have been mapped and are active in the Bitsight platform. They are mapped through a process designed to accurately build an organization's network footprint. The process relies upon tools that automate how changes (new infrastructure that should belong to an organization or no longer belongs to an organization) are continuously identified, similar to processes used across Bitsight infrastructure data sources.

Example:

The example.com domain resolves to a 1.2.3.4 IP address, and then the IP address changes to 2.3.4.5 a few days later.

• This change is automatically detected.
• The 1.2.3.4 IP address stops being attributed to the company.
• IP 2.3.4.5 is added to the company.

If a company you were monitoring becomes inactive, you will be notified and unsubscribed from the company and your quota will be reinstated. If the correct entity is available, a link to their results in the company search page is included in the notification for your review.

Infrastructure Management

Many of the 1000 Largest US Companies have verified our network footprint maps and confirmed that our data accurately represents their organization. Refer to Infrastructure Management to provide feedback on your network footprint.

Where to view your network infrastructure in the Bitsight platform:

• The Attribution tab.
• The company’s Ratings Tree, including the organization’s company hierarchy.

Mapping Process

1. Data Discovery

We have a proprietary internet scanning and data collection infrastructure, Groma, and also use an automated data discovery process to externally collect internet data. Groma is an internet scanning and data collection infrastructure proprietary to Bitsight.

The data includes the following information:

• Company Metadata – An organization’s background information to distinguish companies with similar names, including:
  • Industry
  • Logo
  • Description
• Relevant IP addresses and CIDR blocks.
• Autonomous System Numbers (ASN).
• Domain/hostname.

2. Attribution

The resulting network footprint is organized into buckets that represent each different level of the business hierarchy. Refer to the Attribution Info presented in the Attribution tab of the Security Posture Management application to see the reasons for attribution.

Learn more about:

• ASN and CIDR Blocks
• IP Associations with Passive (pDNS) and Cloud
• Attribution Explainability
• Attribution Method
• Subsidiaries in a Ratings Tree

3. Review and Verification

Once the initial network footprint is complete, it goes through a review process:

• An automatic process reviews the map and checks for correctness and completeness.
• Background information, business relationships, CIDR attachments, ASN, and missing information are verified by a human technical reviewer for final accuracy checks and verification.

Misclassified or missing data can result in the repetition of the review process methodology.