Attack Surface: Infrastructure

The Infrastructure page in the Security Performance Management application [ Attack Surface ➔ Infrastructure] allows you to:

• See externally-facing infrastructure (Assets that are attributed to the organization).
• Report missing infrastructure.
• Set an end date for the association.

These functionalities and information are presented in the following tabs:

• Assets – See assets attributed to your organization.
• Attribution – Manage how infrastructure is attributed to your organization.
• Change Log – Track changes to your network infrastructure.
• Company-Provided Assets – See assets that you’ve requested to be added to your infrastructure (add assets).

Actions

• Add Assets
• Create an Infrastructure Tag
• Generate a Report

Add Assets

Add assets or report missing assets:

1. Select the Add Assets button at the top-right.
2. Enter 1 asset per line and up to 50 assets into the Add Assets text field. Assets can be an IP address, domain, or CIDR.

There’s a validation process when infrastructure is added. The request automatically fails if:

• The IPv4 CIDR block is larger than “/20” (4,094 IP Addresses).
• The IPv6 CIDR block is larger than “/96.”
• The IP address or domain name is misconfigured (example: 1.11.1 or 1.1.abc.1).
• It is a wildcard domain.
• It is a duplicate request.
• The requested asset is already attributed to another organization (excluding service providers).

Create an Infrastructure Tag

1. Select the Manage Tags button at the top-right.
2. Select + Add Tag at the top-right of the Manage Tags window.
3. Select the tag visibility.
4. Assign a name for the tag (up to 30 characters).
5. Select Confirm Tag Edit.
6. Select Continue at the bottom-right of the Manage Tags window.
7. Select Save Changes.

Generate a Report

Generate a report, including:

• Infrastructure
• Infrastructure Changes
• Attack Surface Exposure
• Download Company Report

Select the Reports button at the top-right.

Request Self-Published Rating

Select the Self Publish button at the top-right and refer to the instructions to request a self-published report to be created.