DC604 - Don't Panic: A Hitchhiker's Guide to Your Attack Surface

Don't Panic: A Hitchhiker's Guide to Your Attack Surface with Sarim Khawaja(or: where did all these servers come from?)

The universe is big. Your attack surface is bigger, and unlike the universe, it expands every time someone spins up a bucket, points a forgotten subdomain at a live box, or ships a side project to prod "just to test." Attackers already enumerate all of it. The uncomfortable question is whether you do.

This talk is a practical tour of External Attack Surface Management: recon you run on yourself, continuously, from the outside in. We'll cover how to find what you didn't know you had, why the asset you forgot about is the one that gets you, and where most discovery efforts quietly fall apart. Along the way, we'll run a live scan with an open-source recon tool, against a fictional company on a laptop with no internet connection, and compare what it finds with what the company thinks it owns. Then, at the end, we'll connect it to CTEM, the operating model that decides w