Exposure Management.

What is exposure management?

Exposure management is the ongoing work of finding where an organization is open to risk, judging how serious each case is, and reducing it. It starts from the idea of exposure. NIST defines exposure as the extent to which an organization or stakeholder is subject to a risk. NISTIR 8286 gives a second definition: the combination of likelihood and impact levels for a risk.

What counts as an exposure?

An exposure is anything that raises the chance or the impact of a harmful event. NIST defines the attack surface as the set of points on the boundary of a system, a system element or an environment where an attacker can try to enter, cause an effect on, or extract data from it. Each of those points can be part of an organization’s exposure.

A simple illustration: a login page that anyone on the internet can reach is one such point. How much it matters depends on what it protects and how bad a break-in would be.

How does exposure management work?

The NIST wording points to two questions for every finding: how likely is the harm, and how large would the impact be? The steps repeat as systems change.

• Find the points where the organization can be reached or affected.
• Judge each one by likelihood and impact.
• Reduce the highest exposure first.
• Check again after changes.

How do you reduce exposure?

CISA gives two clear examples. In Binding Operational Directive 23-02, CISA says the risk is compounded if device management interfaces are connected directly to, and accessible from, the public-facing internet. The directive tells US federal agencies to either remove such an interface from the internet by making it reachable only from an internal enterprise network, or to apply zero trust controls that enforce access control through a policy enforcement point separate from the interface itself.

The second example is vulnerability prioritization. CISA maintains the Known Exploited Vulnerabilities catalog, which it describes as the authoritative source of vulnerabilities that have been exploited in the wild. CISA says organizations should use the catalog as an input to their vulnerability management prioritization framework.

How does it relate to nearby terms?

The attack surface is the set of entry points. Exposure adds the question of risk: how likely and how harmful. Vulnerability management is one part of the work, focused on weaknesses in software and systems. Zero trust is one approach that CISA names for limiting access to an interface.

Is exposure management the same as vulnerability management?

No. Vulnerability management deals with known weaknesses in software and systems. Exposure, in the NIST sense, covers any risk the organization is subject to, so a weakness is only one possible cause. An open management interface, for example, is a risk even when no software flaw is involved.

Is exposure management the same as attack surface management?

They overlap but are not identical. Attack surface management focuses on the points where an attacker can try to enter. Exposure management also weighs likelihood and impact, so it asks which of those points matter most.

What is continuous threat exposure management?

This page does not define continuous threat exposure management. The primary public bodies named here (NIST, CISA and ENISA) do not define it in the sources opened for this page, so it is left out rather than guessed.

Brandefense monitors an organization’s external attack surface, which is one source of exposure information.