What is an external-facing asset?
An external-facing asset is an asset that can be accessed from outside the organization. For example, it can be open to the internet, providing content to anonymous users, internal employees, and business partners. An External Facing asset can also enable users to self-register in order to access additional content.
How is the External Face tag created?
The Vulcan Cyber platform creates the tag automatically once it identifies an external-facing asset. External facing assets are tagged "External Facing" if one (or more) of the below conditions is met:
The Security Group of the asset allows inbound connection on the AWS side.
The IP address of the asset is external-facing.
The asset is connected to an ELB on the AWS side, and the status of the Load Balancer is "Active".
When your Vulcan platform identifies external-facing assets, the tag becomes available at:
Assets > Asset Tags > External Facing
View the conditions that make the external-facing tag
Click the "External Facing" tag to view the default conditions as set by Vulcan (this in case you haven't already changed the default conditions).
Once you open the tag, you get to view:
(a) The default criteria as set by Vulcan
(b) The assets that match the defined conditions
The default conditions are:
External Facing by IP
ORExternal Facing by ELB
ORExternal Facing by Security Group
What are your options here?
Keep the default conditions as is
Override the default conditions
Create a new External Facing tag with your own customized conditions in addition to the default one
Create a customized external-facing tag
You can create and set your own conditions for an External Facing tag, along with editing the name and the impact score of the tag.
Go to Assets
At the right pane, click Asset Tags > +Create Asset Tag.
Fill in the asset tag details such as name and impact. Enable the relevant toggles if needed, just like when creating any other asset tag.
When setting the External-Facing asset tag condition, make sure that at least the following condition is set:
Where > Assets > External Facing > is > Security Group and/or IP and/or ELB.Security Group: The Security Group of the asset allows inbound connection on the AWS side.
External Load Balancer (ELB): The asset is connected to an ELB on the AWS side, and the status of the instance the ELB points to is "InService".
IP: Selecting this condition means that the Vulcan Cyber Platform will scan the IP addresses of assets to find the External Facing IP addresses. The scanner disregards internal IP addresses. The internal IP range mainly includes:
Range from 10.0.0.0 to 10.255.255.255 — a 10.0.0.0 network with a 255.0.0.0 or an /8 (8-bit) mask
Range from 172.16.0.0 to 172.31.255.255 — a 172.16.0.0 network with a 255.240.0.0 (12-bit) mask
Range from 192.168.0.0 to 192.168.255.255 — a 192.168.0.0 network with a 255.255.0.0 (16-bit) mask
Range from 169.254.0.0 to 169.254.255.254 — a 169.254.0.0 network with a 255.255.0.0 (16-bit) mask
Range from 127.0.0.0 to 127.255.255.254 — a 127.0.0.0 network with a 255.0.0.0 (8-bit) mask
Your newly created External Facing tag will appear under Assets > Asset Tags > External Facing.