Network Mapping Process

The Bitsight network mapping process is designed to accurately build an organization's network footprint. It relies upon tools that automate how changes (new infrastructure that should belong to an organization or no longer belongs to an organization) are continuously identified, similar to processes used across Bitsight infrastructure data sources.

Example:

The example.com domain resolves to a 1.2.3.4 IP address, and then the IP address changes to 2.3.4.5 a few days later.

• This change is automatically detected.
• The 1.2.3.4 IP address stops being attributed to the company.
• IP 2.3.4.5 is added to the company.

Infrastructure Management

Many of the 1000 Largest US Companies have verified our network footprint maps and confirmed that our data accurately represents their organization. Refer to Infrastructure Management to provide feedback on your network footprint.

Where to view your network infrastructure in the Bitsight platform:

• The Attribution tab.
• The company’s Ratings Tree, including the organization’s company hierarchy.

Mapping Process

• Data Discovery
• Attribution
• Review and Verification
• Fourth Party Data Collection Methods

Data Discovery

Our automated data discovery process externally collects internet data, which includes the following information:

• An organization’s background information to distinguish companies with similar names, including:
  • Industry
  • Logo
  • Description
• Relevant IP addresses and CIDR blocks.
• Autonomous System Numbers (ASN).
• Domain/hostname.

Attribution

The resulting network footprint is organized into buckets that represent each different level of the business hierarchy.

• Subsidiaries in a Ratings Tree
• ASN and CIDR Blocks
• IP Associations with Passive (pDNS) and Cloud
• Attribution Reasons

Review and Verification

Once the initial network footprint is complete, it goes through a review process:

• An automatic process reviews the map and checks for correctness and completeness.
• Background information, business relationships, CIDR attachments, ASN, and missing information are verified by a human technical reviewer for final accuracy checks and verification.

Misclassified or missing data can result in the repetition of the review process methodology.