Jul 07 2025

Attack Surface Management (ASM) trends for 2025

Category: API security,ASM,Cloud computing,Cyber Attack,Information Security,IoT Security — disc7 @ 3:43 pm

  1. ASM Is Evolving Into Holistic, Proactive Defense
    Attack Surface Management has grown from merely tracking exposed vulnerabilities to encompassing all digital assets—cloud systems, IoT devices, internal apps, corporate premises, and supplier infrastructure. Modern ASM solutions don’t just catalog known risks; they continuously discover new assets and alert on changes in real time. This shift from reactive to proactive defense helps organizations anticipate threats before they materialize.
  2. AI, Machine Learning & Threat Intelligence Drive Detection
    AI/ML is now foundational in ASM tools, capable of scanning vast data sets to find misconfigurations, blind spots, and chained vulnerabilities faster than human operators could. Integrated threat-intel feeds then enrich these findings, enabling contextual prioritization—your team can focus on what top adversaries are actively attacking.
  3. Zero Trust & Continuous Monitoring Are Essential
    ASM increasingly integrates with Zero Trust principles, ensuring every device, user, or connection is verified before granting access. Combined with ongoing asset monitoring—both EASM (external) and CAASM (internal)—this provides a comprehensive visibility framework. Such alignment enables security teams to detect unexpected changes or suspicious behaviors in hybrid environments.
  4. Third-Party, IoT/OT & Shadow Assets in Focus
    Attack surfaces are no longer limited to corporate servers. IoT and OT devices, along with shadow IT and third-party vendor infrastructure, are prime targets. ASM platforms now emphasize uncovering default credentials, misconfigured firmware, and regularizing access across partner ecosystems. This expanded view helps mitigate supply-chain and vendor-based risks
  5. ASM Is a Continuous Service, Not a One-Time Scan
    Today’s ASM is about ongoing exposure assessment. Whether delivered in-house or via ASM-as-a-Service, the goal is to map, monitor, validate, and remediate 24/7. Context-rich alerts backed by human-friendly dashboards empower teams to tackle the most critical risks first. While tools offer automation, the human element remains vital—security teams need to connect ASM findings to business context

In short, ASM in 2025 is about persistent, intelligent, and context-aware attack surface management spanning internal environments, cloud, IoT, and third-party ecosystems. It blends AI-powered insights, Zero Trust philosophy, and continuous monitoring to detect vulnerabilities proactively and prioritize them based on real-world threat context.

Attack Surface Management: Strategies and Techniques for Safeguarding Your Digital Assets

You’ll learn:

  • Fundamental ASM concepts, including their role in cybersecurity
  • How to assess and map your organization’s attack surface, including digital assets and vulnerabilities
  • Strategies for identifying, classifying, and prioritizing critical assets
  • Attack surfaces types, including each one’s unique security challenges
  • How to align technical vulnerabilities with business risks
  • Principles of continuous monitoring and management to maintain a robust security posture
  • Techniques for automating asset discovery, tracking, and categorization
  • Remediation strategies for addressing vulnerabilities, including patching, monitoring, isolation, and containment
  • How to integrate ASM with incident response and continuously improve cybersecurity strategies

ASM is more than a strategy—it’s a defense mechanism against growing cyber threats. This guide will help you fortify your digital defense.

Secure Your Business. Simplify Compliance. Gain Peace of Mind

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: ASM, Attack Surface Management

Feb 27 2025

Cyber threats to the Internet of Things (IoT)

Category: IoT Security — disc7 @ 10:06 am

Device Vulnerabilities – Sensors and actuators in IoT devices may have weak security, making them susceptible to unauthorized access, tampering, or exploitation.

Network Attacks – IoT systems rely on networked IT infrastructure, which can be targeted by cyber threats such as data interception, man-in-the-middle (MITM) attacks, and denial-of-service (DoS) attacks.

Data Integrity and Privacy Risks – The transmission of sensitive data (e.g., medical monitoring or environmental data) creates risks of interception, manipulation, or unauthorized access, leading to privacy violations or incorrect system responses.

AI Exploitation – If AI is used for decision-making in IoT systems, it could be vulnerable to adversarial attacks, data poisoning, or biased decision-making that impacts the reliability of the system.

Physical Security Risks – As IoT systems interact with the physical world, compromised devices could cause real-world harm, such as tampering with industrial equipment, medical devices, or environmental monitoring systems.

Insider Threats – Unauthorized or malicious use of IoT devices by internal actors could lead to data leaks, system disruptions, or unauthorized modifications to physical processes.

Lack of Standardized Security Measures – IoT ecosystems often involve diverse devices and manufacturers, leading to inconsistent security implementations, outdated firmware, and a lack of unified security governance.

Here’s a more detailed breakdown of cyber threats to IoT systems:

1. Device Vulnerabilities

  • Insecure Firmware and Software: Many IoT devices have outdated or unpatched firmware, making them easy targets for attackers.
  • Hardcoded Credentials: Some devices come with default or hardcoded passwords that users fail to change, leaving them exposed to brute-force attacks.
  • Lack of Security Updates: Many IoT devices do not support over-the-air updates, leading to long-term security risks.

2. Network Attacks

  • Man-in-the-Middle (MITM) Attacks: IoT devices transmit data over networks, which can be intercepted if communication channels are not properly secured (e.g., lack of encryption).
  • Denial-of-Service (DoS) Attacks: Attackers can flood IoT networks with traffic, rendering critical systems (e.g., medical monitoring or industrial control systems) unusable.
  • Rogue Devices and Spoofing: Attackers can introduce malicious IoT devices into a network to manipulate legitimate data flows or gain unauthorized access.

3. Data Integrity and Privacy Risks

  • Data Tampering: If an attacker manipulates sensor data (e.g., changing environmental monitoring readings), it can lead to incorrect responses or actions.
  • Unauthorized Data Access: IoT systems collect sensitive data, including medical or environmental data, which can be stolen and misused.
  • Lack of Encryption: Many IoT devices do not encrypt data at rest or in transit, making them vulnerable to eavesdropping and data breaches.

4. AI Exploitation

  • Adversarial Attacks: Attackers can manipulate AI models used in IoT decision-making by feeding them incorrect or biased data, leading to incorrect system responses.
  • Data Poisoning: If the AI relies on compromised data from sensors, it could make faulty predictions or automate incorrect actions (e.g., failing to detect a medical emergency).
  • Model Inference Attacks: Attackers could extract sensitive information from AI models used in IoT decision-making, compromising system security.

5. Physical Security Risks

  • Device Tampering: Attackers with physical access to IoT devices (e.g., sensors, cameras, industrial controllers) can modify them to manipulate system behavior.
  • Sabotage: IoT devices in critical infrastructure (e.g., smart grids, industrial control systems) can be physically damaged or disabled, leading to operational failures.
  • Supply Chain Attacks: IoT components can be compromised during manufacturing or distribution, introducing backdoors or vulnerabilities.

6. Insider Threats

  • Unauthorized Access by Employees: Internal users may exploit weak security controls to access sensitive data or manipulate IoT system functions.
  • Misconfigurations: Accidental misconfigurations by employees can expose IoT systems to cyber threats.
  • Malicious Insiders: Employees or contractors with legitimate access may intentionally exploit vulnerabilities to disrupt operations or steal data.

7. Lack of Standardized Security Measures

  • Interoperability Issues: IoT ecosystems consist of multiple vendors with varying security standards, leading to inconsistencies in security practices.
  • Lack of Centralized Security Management: Many IoT deployments lack a centralized security framework, making monitoring and incident response difficult.
  • Weak Authentication and Authorization: Poor access control mechanisms allow unauthorized users or devices to access critical systems.

Conclusion

IoT security threats arise from a combination of device vulnerabilities, network risks, data integrity challenges, AI exploitation, physical security issues, insider threats, and lack of standardized security practices. Securing IoT systems requires a multi-layered approach, including strong encryption, regular firmware updates, AI security measures, access control, and physical security protections.

IoT for Defense and National Security

DISC InfoSec previous posts on IoT security category

What does it mean to live in a world where IoT devices can be weaponized

ISMS and ISO 27k training

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: IoT security

Nov 15 2024

What does it mean to live in a world where IoT devices can be weaponized

Category: IoT Security — disc7 @ 7:15 am
More Details on Israel Sabotaging Hezbollah Pagers and Walkie-Talkies

The blog post discusses Israel’s sabotage of Hezbollah’s communication devices, including pagers and walkie-talkies. This operation aimed to disrupt Hezbollah’s capabilities by modifying these devices to malfunction or reveal information, impacting their command structure and operational security. The post highlights the technical and intelligence challenges in carrying out such operations, emphasizing the complex interplay of cyber and electronic warfare. It also underlines the broader implications for national security, showcasing how these tactics reflect evolving methods in modern conflict, blending physical and cyber tactics.

The piece warns that while technological innovation can push boundaries, not every potential application should be realized. The ethics of technology hinge on its use; what can be a safety patch might easily become an exploit. The advent of weaponized everyday items, like modified batteries, raises significant concerns. While spy agencies may have conceived such tactics, their widespread adoption could enable lesser actors, from gangs to rogue manufacturers, to replicate and deploy them. Immediate global condemnation is essential to prevent the normalization of such dangerous practices in civilian life.

Per statement:I fear that if we do not universally and swiftly condemn the practice of turning everyday gadgets into bombs, we risk legitimizing a military technology that can literally bring the front line of every conflict into your pocket, purse or home.

James Bond used to utilize similar technologies in popular movie where innocent things were turned into deadly weapon.

And no doubt “it is too easy for weaker adversaries to copy the idea and justify its re-deployment in an asymmetric and devastating retaliation.”

Changes in warfare driven by IoT weapons, logistics, and systems – IoT for Defense and National Security

Previous posts on IoT security

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: IoT as a weapon

Aug 18 2021

Kalay cloud platform flaw exposes millions of IoT devices to hack

Category: IoT Security — DISC @ 11:36 am
Kalay cloud platform flaw exposes millions of IoT devices to hack

FireEye Mandiant researchers have discovered a critical vulnerability in the Kalay cloud platform that exposes millions of IoT devices to attacks.

Researchers at FireEye’s Mandiant have discovered a critical vulnerability, tracked as CVE-2021-28372, in a core component of the Kalay cloud platform which is used by millions of IoT devices from many vendors.

The flaw could be easily exploited by a remote attacker to take over an IoT device, the only info needed for the attack is the Kalay unique identifier (UID) of the targeted user. The identifier could be obtained via social engineering.

“The vulnerabilities described in this post affect a core component of the Kalay platform. Mandiant was not able to create a comprehensive list of affected devices; however, ThroughTek’s website reports more than 83 million active devices on the Kalay platform at the time of writing this post.” states the report published by Mandiant. â€śAn attacker would require comprehensive knowledge of the Kalay protocol and the ability to generate and send messages. The attacker would also need to obtain Kalay UIDs through social engineering or other vulnerabilities in APIs or services that return Kalay UIDs. From there, an attacker would be able to remotely compromise affected devices that correspond to the obtained UIDs.”

An attacker that has obtained the UID of a targeted device could send a specially crafted request to the Kalay network to register another device with the same UID on the network. Then the Kalay servers will overwrite the existing device. Once the victim will connect the device, his connection will be directed to the attacker that could obtain the credentials used by the victim to access the device.

Most of the devices using the platform are video surveillance products such as IP cameras and baby monitors, an attacker could exploit this flaw to eavesdrop audio and video data.

The attacker could also use RPC (remote procedure call) functionality to completely take over the device.

Practical IoT Hacking: The Definitive Guide to Attacking the Internet of Things

Tags: IoT, IoT devices, IoT Hacking, IoT security

Aug 04 2021

Do You Trust Your Smart TV?

Category: IoT Security,Security Awareness — DISC @ 10:02 am
Do You Trust Your Smart TV?

Did you ever stop to think that the office smart TV used for company presentations, Zoom meetings, and other work-related activities may not be so trustworthy?

In our latest video, we demonstrate an attack scenario that can occur within any organization – hacking a smart TV. The video shows an insider plugging a USB Rubber Ducky into a smart TV in a company meeting room. Within less than a minute, a payload is executed to set up a Wi-Fi network for data exfiltration (called kitty3) and instructs the TV to connect to it. The payload then uploads a utility that captures the screen before the insider removes the rogue device.

Smart TV Security: Media Playback and Digital Video Broadcast

Tags: Smart TV, Smart TV Security

Jun 19 2021

Preventing security issues from destroying the promise of IoT

Category: IoT Security — DISC @ 12:50 pm
Preventing security issues from destroying the promise of IoT

Tags: IoT Hacking, IoT security

Apr 27 2021

When AIs Start Hacking

Category: AI,IoT Security — DISC @ 5:00 pm
When AIs Start Hacking

If you don’t have enough to worry about already, consider a world where AIs are hackers.

Hacking is as old as humanity. We are creative problem solvers. We exploit loopholes, manipulate systems, and strive for more influence, power, and wealth. To date, hacking has exclusively been a human activity. Not for long.

As I lay out in a report I just published, artificial intelligence will eventually find vulnerabilities in all sorts of social, economic, and political systems, and then exploit them at unprecedented speed, scale, and scope. After hacking humanity, AI systems will then hack other AI systems, and humans will be little more than collateral damage.

Okay, maybe this is a bit of hyperbole, but it requires no far-future science fiction technology. I’m not postulating an AI “singularity,” where the AI-learning feedback loop becomes so fast that it outstrips human understanding. I’m not assuming intelligent androids. I’m not assuming evil intent. Most of these hacks don’t even require major research breakthroughs in AI. They’re already happening. As AI gets more sophisticated, though, we often won’t even know it’s happening.

AIs don’t solve problems like humans do. They look at more types of solutions than us. They’ll go down complex paths that we haven’t considered. This can be an issue because of something called the explainability problem. Modern AI systems are essentially black boxes. Data goes in one end, and an answer comes out the other. It can be impossible to understand how the system reached its conclusion, even if you’re a programmer looking at the code.

In 2015, a research group fed an AI system called Deep Patient health and medical data from some 700,000 people, and tested whether it could predict diseases. It could, but Deep Patient provides no explanation for the basis of a diagnosis, and the researchers have no idea how it comes to its conclusions. A doctor either can either trust or ignore the computer, but that trust will remain blind.

When AIs Start Hacking

Apr 22 2021

Securing vehicles from potential cybersecurity threats

Category: IoT Security,Mobile Security — DISC @ 10:05 am
Securing vehicles from potential cybersecurity threats

Despite thieves regularly finding ways to boost cars by exploiting vulnerabilities in modern keyless locking systems and researchers demonstrating how attackers could fiddle with car settings, the infotainment system, the break system, the steering system, and so on, we’re yet to witness actual safety attacks that resulted in hackers disabling brakes or turning the steering wheel.

One of the reasons must surely be that cybercriminals are generally after money and not that interested in harming people for the fun of it, but perhaps another is that it’s currently very difficult to prove that attacks like these happened.

“If an incident happens there is currently no entity that will investigate such a possibility. Even more so, in most cars there are no measures monitoring for such incidents. So if you try and succeed, no one will even know, not to mention launch an investigation,” notes Nathaniel Meron, Chief Product and Marketing Officer at C2A Security, a provider of automotive cybersecurity solutions.

And, though the IT networks of original equipment manufacturers (OEMs) have already been breached by ransomware gangs, vehicle owners are lucky that those criminals have not yet switched to in-vehicle networks attacks to “brick” cars and demand money.

If and when that happens and depending on the scale of the attacks, Meron recons that they could even bankrupt an OEM.

But while it’s difficult to say when this “grace period” might end, OEMs should accept as fact that one day it surely will, and they should use this time to work on defenses.

Securing vehicles from potential cybersecurity threats

Tags: Securing vehicles

Apr 15 2021

IoT bug report claims “at least 100M devices” may be impacted

Category: IoT Security — DISC @ 8:21 am
IoT bug report claims “at least 100M devices” may be impacted

The devil’s in the details

The NAME:WRECK report isn’t just one bug or one vulnerability, and all of them date back to last year except for one.

Fortunately, they are all patched (at least one has had an update out for nearly a year already) but together they constitute a worthwhile reminder that even in the modern age, programmers continue to make old-school coding mistakes.

The vulnerabilities that have been lumped together under the NAME:WRECK “brand” were found in three different operating systems.

Two were low-level operating systems, often known as RTOSes (short for real-time operating systems) dedicated to internet-of-things (IoT) devices, namely Nucleus NET from Siemens and NetX from Microsoft.

The third was FreeBSD, widely used as both a mainstream server operating system and as an operating system for embedded devices. (As the name suggests, FreeBSD is available for free, like Linux, but it uses a much more easy-going and liberal open source licence.)

Parsing errors and randomness problems

Tags: IoT bug report

Aug 22 2020

New Vulnerability Could Put IoT Devices at Risk

Category: IoT Security — DISC @ 11:36 am

A new vulnerability targets Thales, a leading maker of IoT components. Learn how the X-Force Red team identified the security flaw and best practices for addressing the risk.

Society relies so heavily on technology that the number of internet connected devices used globally is predicted to grow to 55.9 billion by 2025. Many of these devices span parts of Industrial Control Systems (ICS) that impact the physical world, assist us in our daily lives at home and monitor and automate everything from energy usage to machine maintenance at work. The potential to abuse these systems has already caught the eye of cybercriminals; according to the 2020 IBM X-Force Threat Intelligence Index, attacks against these systems increased over 2000% since 2018.

As part of their ongoing research, IBM’s team of hackers, X-Force Red, have discovered a new IoT vulnerability that can be exploited remotely. The manufacturer, Thales, has made a patch available for CVE-2020-15858 to customers since February 2020 and X-Force Red has been working together to ensure users are aware of the patch and taking steps to secure their systems.

Of the billions of smart devices in use today, Thales is one of leading makers of components that enable them to connect to the internet, securely store information and verify identities. Thales’ entire portfolio connects more than 3 billion things every year and more than 30,000 organizations rely on its solutions for everything from smart energy meters to medical monitoring devices and cars.

Source: New Vulnerability Could Put IoT Devices at Risk



How dangerous are IOT devices? | Yuval Elovici | TEDxBGU
httpv://www.youtube.com/watch?v=vgoX_m6Mkko



The IoT Architect’s Guide to Attainable Security and Privacy




Download a Security Risk Assessment Steps paper!

Security Risk assessment Quiz – Find Out How Your security risk assessment Stands Up!

DISC InfoSec 🔒 securing the business 🔒 via latest InfoSec titles

Subscribe to DISC InfoSec blog by Email

👉 Download a Virtual CISO (#vCISO) and Security Advisory Fact Sheet & Cybersecurity Cheat Sheet




Aug 19 2020

IBM finds vulnerability in IoT chips present in billions of devices

Category: IoT Security,Security vulnerabilities — DISC @ 11:49 am

Manufactured by Thales, the EHS8 module family has security flaws that could allow attackers to take total control over internet-connected industrial machines.

Source: IBM finds vulnerability in IoT chips present in billions of devices

 

Download a Security Risk Assessment Steps paper!

Security Risk assessment Quiz – Find Out How Your security risk assessment Stands Up!

DISC InfoSec 🔒 securing the business 🔒 via latest InfoSec titles

Subscribe to DISC InfoSec blog by Email

👉 Download a Virtual CISO (#vCISO) and Security Advisory Fact Sheet & Cybersecurity Cheat Sheet




Jun 01 2020

26 IoT Flaws Enable Denial-of-Service Attacks, Privilege Escalation

Category: IoT Security — DISC @ 6:07 pm

Research details vulnerabilities in the Zephyr Real Time Operating Systems and MCUboot, both used in IoT devices and sensors.

Source: 26 IoT Flaws Enable Denial-of-Service Attacks, Privilege Escalation



Regulating the Internet of Things
httpv://www.youtube.com/watch?v=b05ksqy9F7k

Fixing the Mess of IoT Security
httpv://www.youtube.com/watch?v=l1TWGThB5gI





Download a Security Risk Assessment Checklist paper!

Subscribe to DISC InfoSec blog by Email




May 03 2019

Creating A Cyber Secure Home

Category: Information Security,IoT Security — DISC @ 9:23 am

Creating A Cyber Secure Home – Infographic via SANS Institute

 Subscribe in a reader




Tags: cyber secure home, home security

Feb 25 2019

Smart Homes at Risk Due to Unpatched Vulnerabilities, Weak Credentials

Category: IoT Security — DISC @ 5:16 pm

40.8% of smart homes have at least one device vulnerable to remote attacks, a third of them being vulnerable because of outdated software with unpatched security issues, while more than two-thirds are exposed by weak credentials.

Source: Smart Homes at Risk Due to Unpatched Vulnerabilities, Weak Credentials