DC604 - Don't Panic: A Hitchhiker's Guide to Your Attack Surface

Don't Panic: A Hitchhiker's Guide to Your Attack Surface with Sarim Khawaja (or: where did all these servers come from?) The universe is big. Your attack surface is bigger, and unlike the universe, it expands every time someone spins up a bucket, points a forgotten subdomain at a live box, or ships a side project to prod "just to test." Attackers already enumerate all of it. The uncomfortable question is whether you do. This talk is a practical tour of External Attack Surface Management: recon you run on yourself, continuously, from the outside in. We'll cover how to find what you didn't know you had, why the asset you forgot about is the one that gets you, and where most discovery efforts quietly fall apart. Along the way, we'll run a live scan with an open-source recon tool, against a fictional company on a laptop with no internet connection, and compare what it finds with what the company thinks it owns. Then, at the end, we'll connect it to CTEM, the operating model that decides what to actually do with everything you've found so it doesn't just rot in a dashboard. Concrete starting points for teams of one. Zero product pitches. About the speaker Sarim Khawaja is Head of Product at Styx Intelligence, where he spends his days on how organizations see, and fail to see, their own external attack surface. He suspects effective security involves far less dashboard-staring and far more community collaboration. As founder of the White-Hat Security Community and an organizer with PM Hive and ISACA Vancouver, he's set on giving Vancouver's security and product crowd a place to gather, swap war stories, and work out which of their 4,000 "critical" findings actually matter.