Publish authorized attack-surface management discovery and evidence workflows

[szmyty]

Outcome

Publish reusable Attack Surface Management (ASM) workflows that continuously inventory Ego Hygiene-owned public exposure, detect drift, and produce actionable evidence without turning organization discovery into unauthorized scanning of third parties.

Architecture

canonical owned asset inventory
        +
approved discovery sources
        ↓
Relay ASM discovery/verification
        ↓
observed domains / services / public endpoints
        ↓
reconciliation + drift + ownership state
        ↓
private details + safe Observatory summary

The canonical ownership inventory remains outside scanner output; observations reconcile against declared ownership rather than becoming truth automatically.

Scope

Support authorized discovery and monitoring of assets such as:

• organization/product domains and subdomains;
• GitHub Pages/custom-domain deployments;
• public application origins;
• documented APIs/endpoints;
• public package/container registries where relevant;
• certificates/TLS identities;
• DNS records;
• externally reachable services explicitly within scope.

Safety and authorization

• Maintain explicit organization-owned/authorized scope.
• Passive discovery may identify unknown candidates, but candidates must not automatically become active-scan targets.
• Never expand scope from third-party DNS/CDN/SaaS relationships into infrastructure not owned or authorized by Ego Hygiene.
• Respect rate limits and provider terms.
• Default to passive or low-impact verification.
• Require separate explicit approval before any intrusive service testing; DAST/penetration-testing behavior belongs in the appropriate profile.
• Avoid publishing sensitive topology, origin addresses, exploitable ports, or vulnerability details.

Discovery sources and adapters

Evaluate maintained, reproducible sources/tools for:

• declared repository/site manifests;
• DNS and certificate transparency observations;
• GitHub Pages/custom domains;
• approved cloud/deployment inventory where connected;
• HTTP/TLS reachability and metadata;
• other passive public observations.

Adapters must identify source, timestamp, confidence, and collection method. Do not rely on a single opaque vendor as the canonical inventory.

Reconciliation model

Classify observed assets as, for example:

• declared and observed;
• declared but unavailable;
• newly observed / needs ownership review;
• deprecated but still exposed;
• redirected/moved;
• third-party dependency;
• unauthorized/out-of-scope candidate;
• unknown;
• stale observation.

Detect meaningful drift such as:

• unexpected new subdomain;
• expired or changed certificate;
• old deployment still reachable;
• DNS record that no longer matches declared architecture;
• public service that lacks an owning repository/product;
• site expected to exist but unavailable.

Evidence and reporting

• Produce durable machine-readable inventory snapshots and diffs.
• Preserve source/provenance and observation times.
• Make high-risk details available only to authorized maintainers.
• Emit safe aggregate posture/freshness data for egohygiene/observatory#4.
• Support scheduled execution and manual verification.
• Fail visibly when discovery sources/tools are unavailable rather than presenting stale data as current.

Acceptance criteria

• Relay exposes a versioned ASM discovery/reconciliation workflow.
• Active scope comes from explicit declared ownership/authorization.
• Passive unknown discoveries require review before becoming scan targets.
• Third-party provider infrastructure is excluded unless separately authorized.
• Inventory snapshots preserve provenance, confidence, and observation time.
• Drift between declared and observed exposure is reported.
• Deprecated-but-still-live and unknown assets are visible.
• Detailed potentially exploitable topology remains non-public.
• A safe aggregate summary can feed Observatory/Trust Center.
• Scheduled and manual modes are documented and tested.

Dependencies / related

• Define a secure reusable workflow catalog and contract #1
• Publish safe reusable DAST profiles for deployed web applications #19
• Publish an evidence-backed public Trust Center read model observatory#4
• feat(assurance): establish enterprise security, privacy, and compliance baseline empathy#51

Non-goals

• Unauthorized internet-wide scanning.
• Treating every discovered third-party service as an Ego Hygiene asset.
• Replacing a canonical repository/domain inventory with scanner observations.
• Publishing detailed external attack-surface data to the public Trust Center.