Sections 6 & 7
External Attack Surface Management (EASM) & Cloud Security
Page 6 of 10
Domain & DNS Security
- • Enforce DMARC
p=rejectorp=quarantine. - • Verify SPF record has under 10 DNS lookups and ends in
-all. - • Audit dangling CNAME records to block subdomain takeovers.
Cloud Storage & Shadow AI
- • Account-level Block Public Access on AWS S3 & Azure Blobs.
- • Rotate IAM keys every 90 days or adopt OpenID Connect.
- • Enforce DLP rules blocking corporate data entry into public AI tools.