How to Use the Amass Open Asset Database
In the contemporary digital landscape, organizations face a myriad of perpetual cyber threats. As organizations expand their digital footprints, their "attack surface" proportionally increases, offering cybercriminals more opportunities for exploitation. Attack Surface Management (ASM) is a proactive security approach that systematically identifies, assesses, and secures the ever-expanding points of potential exposure. Effective ASM requires detailed knowledge of one’s digital footprint and the solution for this is Amass, a powerful attack surface mapping framework.
Origins of Amass
Amass was created by Jeff Foley in 2017 as a simple command line utility to automate the reconnaissance process. Foley’s background in cybersecurity is deeply rooted in the defense industry where attack surface mapping and offensive capabilities are decades ahead of mainstream security practices. Motivated by the time-consuming and error prone nature of manual intelligence gathering, Jeff set out to create a tool that could reliably collect, track, and map attack surfaces. Initially shared with Jeff’s peers, Amass quickly caught the attention of the information security community, who encouraged him to release the tool as open source.
Today, Amass is managed by the Open Source Foundation for Application Security (OWASP). The OWASP foundation is a non-profit global initiative committed to promoting secure software practices through education, open source tools, and collaboration. As an OWASP flagship project, Amass is funded, actively maintained, and widely regarded as the most popular attack surface mapping solution.
What is the Open Asset Database?
Navigating the complex realms of the digital world demands a comprehensive understanding of assets and their intricate connections. The Open Asset Model (OAM) emerges as a beacon in this context, presenting a comprehensive viewpoint that encompasses both physical and digital assets, and explaining their deep-rooted interconnections. As a natural extension of OAM's vision, the Asset Database initiative takes center stage. It isn't just another tool but; rather, it's a thoughtfully crafted blueprint designed for setting up databases that resonate harmoniously with the principles laid down by the OAM.
Integrating seamlessly into the broader canvas of the OWASP Amass project, the Asset Database exemplifies a shift in asset management paradigms. It fosters a more holistic approach to unraveling an organization's digital landscape. With the foundational ethos of OAM and the structured guidance found in the asset-db repository, the Amass project is not just evolving but transforming, setting new benchmarks in the domain of asset discovery and cohesive management. The convergence of these elements underscores the future of efficient and insightful asset management.
The Need for the Open Asset Database
In the ever-evolving digital realm, one of the most pressing challenges has been the decentralization of data collection. Various tools and data sources have historically operated in silos, each offering information in disparate formats, leading to fragmentation and potential gaps in asset knowledge. The Open Asset Database (asset-db) was conceived to tackle this very challenge. It provides a unified platform that standardizes data formats, allowing diverse tools and sources to seamlessly communicate with the Open Asset Model. By integrating data into one centralized database, asset-db simplifies and streamlines the asset management process. Now, tools and data sources can effortlessly tap into this unified repository, ensuring consistency, reducing redundancies, and paving the way for more efficient asset management.
How to Use the Open Asset Database
The Open Asset Database provides a structured foundation for managing and analyzing your digital assets. Before diving into analysis using the OAM suite of tools, it's crucial to ensure that the database is set up correctly. Users have the option to work with either PostgreSQL or SQLite, depending on their specific needs.
For users who prefer a more lightweight setup or those who do not wish to utilize PostgreSQL, Open Asset Database offers SQLite as an alternative. The SQLite file for this purpose is located based on your operating system. Once you have the chosen database up and running, the oam-tools suite stands ready to drive your asset management tasks. With tools like oam_subs, extracting data from your graph database is straightforward. For instance, using the command:
oam_subs -d example.com
You can retrieve all available details about example.com from the graph database, granting you a comprehensive overview of your IT assets.
When used in conjunction with the OAM tools, the Open Asset Database becomes an indispensable resource for digital asset management. Whether you opt for PostgreSQL or SQLite, the Open Asset Database ensures a smooth and user-friendly experience from initial setup to advanced analysis. For those hungry for deeper insights, our extensive technical documents can be found on GitHub.
Why ZeroFox is Investing in Amass
At ZeroFox, we wholeheartedly endorse the principles and values championed by Amass. The expansive digital landscape calls for a proactive approach to cybersecurity, a philosophy embodied in Attack Surface Management (ASM); a method that diligently pinpoints, evaluates, and fortifies potential exposure avenues. Understanding the imperative of a thorough digital footprint comprehension, we've recognized Amass as the de facto solution, epitomizing the zenith of attack surface mapping frameworks.
Our commitment to this vision led us to tackle the once fragmented data collection landscape, resulting in our pivotal role in pioneering the Open Asset Database. This innovation standardizes and centralizes data, making it easily integrable with the Open Asset Model.It also reaffirms our dedication not just to enhancing Amass but to uplifting the entire open source cybersecurity ecosystem. This shared commitment and vision illustrate ZeroFox's unwavering commitment to pushing the frontiers of digital protection and open collaboration.
Learn More and Download Amass
If this vision resonates with your ideals, please feel free to join the OWASP Amass Project. Your expertise and passion can be the catalyst that makes all the difference. To learn more about the Amass project join the community Discord Server.