IT Infrastructure Mapping: A Pillar of Cybersecurity

Introduction

In an ever-evolving digital environment, cybersecurity has become a top priority for all companies.

Mapping the IT infrastructure is therefore a crucial step to ensure the protection of systems, anticipate threats, and improve risk management.

But why? And what exactly is mapping? What purpose does it serve?

What is Mapping?

In practical terms, mapping the IT infrastructure involves visually representing all the components of a company’s information system.

It means creating a detailed map of the equipment, software, networks, data, and users that make up the information system.

Obviously, this map is evolving and should be regularly updated to reflect changes and developments in the IT infrastructure.

There are several types of maps.

Static Maps

Static maps are snapshots of the IT infrastructure at a given moment.

They provide a view of the state of the information system at a specific time and help spot potential anomalies or weak points.

Dynamic Maps

Dynamic maps are real-time representations of the IT infrastructure.

They provide a real-time view of all the components of the information system and allow quick detection of incidents or attacks.

Why Map Your IT Infrastructure?

Now, let’s get to the core of the topic: why map the IT infrastructure of your company?

Well, for 3 main reasons.

1. Visibility and Control of Assets

A company has a multitude of interconnected devices: servers, workstations, networks, applications, and databases. Without a clear overview, it becomes difficult to understand and control the interactions between these different components.

2. Identifying Vulnerabilities

A detailed map allows you to spot weak points in the infrastructure, such as outdated systems, obsolete software, or incorrect configurations, which can be exploited by cybercriminals.

3. Optimizing Incident Response

In the event of a cyberattack, having an accurate map of the IT resources allows you to respond more quickly and effectively, by locating and isolating compromised elements.

In short, mapping the IT infrastructure is an essential tool to strengthen the cybersecurity of your company and reduce the risks of compromise.

But how can it be done properly?

Mapping Tools

Several tools can help create a map of the IT infrastructure.

First and foremost, it is important to determine your needs. What do you want to map? Your external exposure, your internal infrastructure, your applications, your network, your data, your users?

Depending on your needs, you can choose a suitable tool.

Network Mapping Tools

Network and internal infrastructure mapping tools allow you to visualize the devices and connections within the computer network.

A well-known example is the classic Nmap, and its Windows counterpart SoftPerfect Network Scanner (one of my favorites for network mapping).

Application Mapping Tools

Application mapping tools allow you to represent the interactions between different applications and databases.

Examples include the popular Lucidchart, Draw.io, and Excalidraw.

Unfortunately, there is no universal tool for mapping an entire company’s IT infrastructure. It is often necessary to combine several tools to get a comprehensive and accurate view of the information system.

External Infrastructure Mapping Tools

Finally, external infrastructure mapping tools allow you to visualize exposed elements on the Internet and identify potential security gaps.

Examples include Shodan, Censys, and Nmap, which are capable of mapping exposed elements on the Internet.

And this is where our tool Flawfence comes into play!

Protecting Your External IT Infrastructure

Identifying Exposed Assets

Step 1: Identify Subdomains, IP Addresses, and Virtual Hosts

The first step in protecting your external IT infrastructure is to identify exposed assets on the Internet.

This is what Flawfence does by first discovering the different subdomains of your company from its main domain.

Flawfence then identifies the IP addresses associated with these subdomains and the services exposed on these IP addresses.

The tool is also capable of discovering the various vhosts used to detect potentially exposed applications.

Finally, an analysis of the different technologies used is performed to add an extra layer of context to the mapping.

Step 2: Identify Cross-Domain Assets

Flawfence can identify the cross-domain assets used by your company.

These are domains related to your company but not necessarily directly under your control.

These domains might be used by partners, contractors, or third-party services, hence the term Shadow IT.

Step 3: Consolidate Everything!

Finally, Flawfence consolidates all the collected information to provide an overview of your company’s external IT infrastructure.

This allows you to regain control over your external exposure and strengthen your company’s cybersecurity!

Identifying Exposed Services

Step 1: Identify Technologies in Use

Flawfence is capable of identifying the exposed services and technologies on the various IP addresses of your company.

The tool analyzes service banners to determine the technologies used and their associated versions based on previously collected information.

Step 2: Consolidate the Information

Flawfence then consolidates all the collected information to provide an overview of the services exposed on the Internet.

This mapping allows you to identify:

• Active subdomains from your main domain.
• Cross-domain assets used by your company.
• IP addresses associated with these domains.
• Exposed web services and technologies on these IP addresses.

This helps quickly identify potential vulnerabilities and facilitate audit planning to enhance the security of your external IT infrastructure!

Conclusion

Mapping the IT infrastructure is a pillar of cybersecurity. It allows you to visualize all assets of the company, identify vulnerabilities, and optimize incident response.

However, this simple methodology has its limits:

• No active scans to detect all exposed services.
• No verification of exploits.
• Requires a human perspective to interpret the results.

This is why Flawfence takes over with its alert module and active vulnerability scanning.

But that’s for another article!

In the meantime, feel free to contact us to discover Flawfence and strengthen your company’s cybersecurity!