DIKW Level 2: Organized Information
Now you're adding context and organization to raw data from Phase 1. You transform unprocessed identifiers into structured information by answering "What is it, who owns it, and what does it do?" for each asset through classification, categorization, and metadata enrichment.
From Raw Data...
api.staging.example.com
192.168.1.100
2024-01-15T14:30:00Z
...To Contextualized Information
- Type: API Endpoint (Subdomain)
- Environment: Staging
- Owner: Engineering Team
- Business Function: E-commerce Platform
- Criticality: Medium
- Status: Active, Monitored
Next Step: Phase 3 (Analyze) transforms this organized information into knowledge by understanding relationships, patterns, and risks.
From Data to Information: Adding Context
Raw data becomes information when you add structure, context, and meaning. While Phase 1 answered "What exists, where, and when?" without context, Phase 2 now answers "What is it, who owns it, and what does it do?"—transforming your discovered assets into an organized inventory enriched with metadata about type, ownership, purpose, and business function.
The Information Layer: Classification & Context
Transform raw asset data by adding structured metadata across multiple dimensions:
Asset Classification
- Type: Domain, Subdomain, IP, Certificate, API Endpoint
- Technology: Cloud provider, framework, service type
- State: Active, dormant, decommissioned, dangling
- Exposure: Public, internal, partner-facing
Business Context
- Ownership: Team, department, vendor
- Purpose: Production, staging, development, testing
- Business Function: E-commerce, API, marketing, etc.
- Data Classification: PII, financial, public, internal
Key Vulnerability Types (Free Preview)
- Subdomain Takeover: Occurs when a subdomain points to an external service (S3 bucket, Azure blob, Heroku app) that's been deprovisioned, allowing attackers to claim it.
- Dangling DNS Records: DNS entries pointing to resources that no longer exist, creating opportunities for takeover attacks.
- Certificate Vulnerabilities: Expired, weak, or misconfigured TLS certificates that compromise secure connections.
- Email Authentication Gaps: Missing SPF, DKIM, or DMARC records that enable email spoofing and phishing.
- DNS Misconfigurations: Open resolvers, permissive zone transfers, and wildcard DNS records that expose sensitive information.
- Digital Supply Chain Risks: Dependencies on third-party suppliers, vendors, or service providers that are no longer in operation, have been acquired, or where you no longer have an active business relationship, creating potential security gaps and unmonitored attack vectors.
Identification Techniques
- Automated Vulnerability Scanning: Use specialized tools to detect takeover risks and DNS issues at scale.
- Certificate Monitoring: Track certificate expiration dates and identify weak cryptographic configurations.
- Email Authentication Testing: Verify SPF, DKIM, and DMARC implementation across all sending domains.
- DNS Configuration Audits: Review nameserver settings, zone files, and delegation patterns.
- Cloud Resource Validation: Ensure all DNS records point to active, claimed resources.
Academy Members Get Full Access
Master vulnerability identification with hands-on training, automated scanning tools, and expert remediation guidance.
Expert Training
- Subdomain takeover identification and prevention
- Certificate vulnerability assessment
- Email security configuration deep dives
Scanning Tools
- Automated vulnerability detection scripts
- Certificate monitoring dashboards
- DNS misconfiguration checkers