pzaino / open-asset-model

Asset definitions for an organization's external attack surface

open-asset-model

Asset definitions for an organization's external attack surface

Context

It all started at a panel back in 2022. Jeff Foley, the amass project lead, was asked the question “What is an attack surface - is it simply internet infrastructure assets?”. Having written an asset collection tool designed specifically for this purpose, you might expect him to say “that’s exactly right”. But he didn’t.

Amass has more or less commoditized the IT asset collection process and made it freely available across numerous platforms. As it has grown in popularity, the team spent a lot of time thinking about how it could better support the needs of its users. For this reason, we imagined the Amass ecosystem, which includes this project - the Open Asset Model. This is a community-driven effort to uniformly describe assets that belong to both organizations and individuals.

Asset specifications have traditionally focused upon the technical, infrastructure-specific things that can be discovered on the internet. While this represents a potentially significant portion of an organization's assets, it is also limiting. The Open Asset Model seeks to expand on this and cover the breadth and depth of both physical and digital assets so that an organization can realize their full attack surface.

Open Asset Model defines not just the assets themselves, but also the relationships within and across types of assets. This allows the model to express the real-world interconnectedness that exist between assets. For details, refer to the Taxonomy documentation.

Goals

• To provide a transport specification that enables organizations to exchange their asset inventory both internally and externally
• To have the aforementioned specification represent the breadth and depth of assets that belong to both organizations and individuals.
• To drive awareness that the attack surface is much larger than your internet infrastructure.
• To enable a community-driven approach to maintaining and improving a model that every security organization’s asset inventory should encompass.
• To provide the ability to capture intricate relationships among different asset types, mirroring the real-world interconnectedness that exists between assets. This approach allows security professionals to identify critical attack vectors that might otherwise remain hidden.

Future Plans

• Evaluate and improve the initial model - Domains, IP Addresses, Autonomous Systems, Netblocks, and Regional Internet Registry Orgs.
• Support additional IT assets that were not in the initial model
  • Certificates
  • Tech Stack
• Extend the model to represent a more expansive view of what the community is calling External Attack Surface
  • Organizations & Enterprises
  • Mobile Applications
  • Social Applications
  • Accounts and Credentials
  • API endpoints
  • Cloud Vendors and 3rd Parties
  • VIPs, Executives and Key Personnel
  • Physical Locations
• Make Open Asset Model available for other programming languages.

Contributing

Open Asset Model is only as good as the community that's backing it. If the aforementioned goals resonate with you, we'd love to have your help. This could be a bug or suggestion you drop in an issue, a suggestion or improvement to the taxonomy, starting a discussion on Discord, or even tweaking a line (or character) or two in the project.

Our CONTRIBUTING.md document contains details on how to get started.

Assets

Supported asset types:

Asset	Type definition
Fully Qualified Domain Name	FQDN
Autonomous System	AutonomousSystem
Regional Internet Registry Organization	RIROrganization
IP Address	IPAddress
Netblock	Netblock

Documentation

The documentation can be found in the Go packages repository: open-asset-model, there you can find the reference and descriptions to the types.

You can also refer to the Taxonomy documentation for specific details on each asset types and their relationships.

Contributing

We are always happy to get new contributors on board! Please check CONTRIBUTING.md to learn how to contribute to our codebase, and join our Discord Server to discuss current project goals.

Licensing

This program is free software: you can redistribute it and/or modify it under the terms of the Apache license.