Finding the agency systems you forgot: external attack surface reviews

Reference article · 6 min read

Most agency incidents that start from the internet do not start on a system the security team was watching. They start on something that was never on the list: a microsite a former vendor stood up for a grant program and left running, a video recorder wired into a camera network and given its own connection so a supervisor could check footage from home, a subdomain that still points at a cloud storage bucket the county stopped paying for, a remote desktop port opened during an emergency and never closed.

An external attack surface review is the practice of finding those systems deliberately, on a schedule, from the outside, using the same public records an attacker would use. It is not a single scan and it is not a report you file. It is an inventory you build once from ownership records and then correct every quarter, paired with a decision about who is responsible for each item on it.

What counts as external attack surface

The working definition is anything reachable from the public internet that a reasonable person would associate with your agency. That is broader than the servers in your data center.

Domains and subdomains. Every name in every zone you control, including names delegated to vendors and names left over from campaigns, elections, and one-time programs.
IP space. Netblocks assigned directly to the agency, ranges assigned by your ISP, and addresses you rent inside cloud providers.
Cloud tenants and accounts. Including accounts opened by a department with a purchasing card and never reported to IT.
Vendor-hosted systems that carry your name. Permit portals, payment pages, job boards, and citizen request systems that live on a vendor's infrastructure but that the public treats as yours.
Building and field systems. Cameras and recorders, HVAC and lighting controllers, door access panels, irrigation and metering equipment, and any remote support path a maintenance contractor uses.
Remote access. VPN appliances, remote desktop, file transfer servers, and third-party remote support tools.

Build the inventory from ownership records, not memory

Asking staff what is internet-facing produces the list of things people remember. Build from records instead, then reconcile.

Registrar accounts. Pull every domain billed to the agency, including ones registered under an individual employee's name or card.
DNS zone exports. Export the full zone for each domain rather than spot-checking names, and include zones hosted by vendors.
Regional internet registry records. Look up the agency in the registry serving your region to find netblocks and autonomous system records registered to you, and ask your ISP for a written list of ranges assigned to your circuits.
Certificate transparency. Publicly logged TLS certificates reveal hostnames that were never in your documentation, including staging and test names.
Finance and procurement records. Search invoices and card statements for hosting, domain, and SaaS vendors. This is usually the fastest way to find systems IT has never seen.
Interconnection agreements. Every memorandum with a court, a school district, a regional dispatch center, or a utility implies a path someone maintains.

Free and low-cost help exists for state, local, tribal, and territorial governments, including scanning and information sharing services offered through federal and nonprofit channels. Availability and terms of these programs change, so confirm current offerings directly with the provider before building a process around them.

What to look for each quarter

New hosts and names since the last review, with a reason for each one.
Dangling DNS records pointing at cloud resources, hosting accounts, or vendor platforms you no longer control. These allow an outsider to claim the resource and serve content from your domain.
Certificates that are expired, self-signed, or issued to hostnames nobody recognizes.
Exposed management and remote access, including remote desktop, database ports, printer and device web panels, and appliance admin consoles.
End-of-life software and appliances that no longer receive vendor patches.
Domains approaching expiration, plus lookalike domains registered by others.
Anything with no named owner. An asset without an owner is the one that will still be unpatched next year.

Who owns remediation when the asset belongs to a department

Discovery is the easy half. The hard half is a system that belongs to Public Works, was bought by Public Works, and is defended by Public Works as essential.

Write the decision rights down before you need them. A workable policy names an accountable owner of record for every external asset, gives IT or the security office explicit authority to disconnect an asset that poses immediate risk, sets an escalation path from department head to CIO to the chief administrative officer, and requires any exception to be a written risk acceptance signed by someone with budget authority and given an expiration date. Standing exceptions with no end date are how forgotten systems become permanent.

How this differs from a scheduled penetration test

A penetration test is scoped by you. You hand the tester a list, they go deep on that list, and they tell you how far an attacker could get. The list is the limit. If the forgotten camera recorder is not on it, the test says nothing about it.

An external attack surface review inverts the inputs. Nobody supplies the scope; the scope is derived from public ownership records, which is how an attacker builds it. The output is breadth rather than depth: an inventory, a set of exposures, and an owner for each. The two fit together. Run the surface review first and let its results set the scope of the next penetration test.

What to ask vendors and how to start

If you buy a service, ask how they discover assets and which public data sources they use, how they attribute an asset to you and what evidence they show, how often the inventory refreshes, whether they perform any active exploitation and under what written authorization, how quickly they notify you of a critical exposure, and what source addresses their scanners use so your monitoring team is not chasing them.

In the contract, require a machine-readable export of the full inventory on demand and again at termination, evidence attached to each attributed asset so you can dispute mistakes, defined notification timelines, a prohibition on exploitation without written approval, and clear terms on data ownership and deletion.

To start without a purchase: export your domains and zones, request your IP assignments in writing from your ISP, search a quarter of purchasing records for hosting and domain charges, assign an owner to every item you find, and put the next review on the calendar. HQT works with state and local agencies on cybersecurity and systems engineering, including external inventory and exposure review practices.

Frequently asked questions

What is an external attack surface review?

It is a recurring process of identifying every system reachable from the public internet that is associated with your agency, built from ownership records such as domain registrations, DNS zones, IP assignments, cloud accounts, and purchasing records. The goal is to find assets nobody remembered, assign each one an accountable owner, and track exposures over time. It differs from a one-time scan because the inventory is maintained and reconciled on a schedule.

How is an attack surface review different from a penetration test?

A penetration test is scoped by the agency and goes deep on the systems you list, so it cannot tell you anything about systems you forgot to include. An attack surface review derives its scope from public records rather than from your list, which is how an outside attacker builds a target set. Many agencies run the surface review first and use its results to set the scope of the next penetration test.

How often should an agency review its external attack surface?

A quarterly cadence works for most state and local agencies, with the inventory rebuilt from ownership records rather than carried forward from the previous review. Agencies with frequent vendor turnover, seasonal program sites, or large field device populations often benefit from a shorter cycle or continuous monitoring. The cadence matters less than whether each review ends with owners assigned and dated remediation commitments.

What do we do when the exposed system belongs to another department that will not fix it?

Resolve this in policy before it becomes a dispute. A workable policy names an accountable owner for every external asset, gives the security office explicit authority to disconnect an asset that poses immediate risk, defines an escalation path through the department head to the CIO and chief administrative officer, and requires any exception to be a written risk acceptance signed by someone with budget authority. Every exception should carry an expiration date so it is revisited rather than forgotten.

Do we need to buy a tool to do this?

No. A first pass can be assembled from your registrar accounts, full DNS zone exports, a written list of IP ranges from your internet service provider, cloud billing records, and a search of purchasing records for hosting and domain charges. Free scanning and information sharing services are also offered to state and local governments through federal and nonprofit channels, though availability and terms change, so confirm current offerings with the provider. Commercial tools mainly add continuous refresh and attribution at scale rather than capability you cannot otherwise obtain.