Vulnerability Monitoring System (GMO ASM)
Overview
GMO ASM (official name: "GMO Cyber Attack Net de Shindan ASM") is a domestically developed ASM (Attack Surface Management) tool provided by GMO Cybersecurity by Ierae. It identifies your organization's IT assets reachable from the internet, then continuously diagnoses and visualizes the vulnerabilities in them.
Traditional vulnerability assessments are performed at a point in time against a target you specify. ASM differs in that it starts by discovering what the targets are and repeats periodically.
This document is a general explanation based on public information. Features, coverage, pricing, and contract terms may change, so always check the provider's latest information when evaluating adoption.
Why ASM Is Needed
- Unknown assets (shadow IT): Past campaign sites, test environments, domains from acquired organizations, and servers with no known owner are not in any inventory, yet become entry points for attackers.
- Attackers look from the outside: Attackers start from public information (domains, IP addresses, certificates, banners). Viewing your own organization from the same perspective is essential.
- Vulnerabilities are disclosed quickly: New vulnerabilities appear every day. With an annual assessment, you are exposed between assessments.
- Network devices and middleware: Vulnerabilities in perimeter products such as VPN appliances and webmail continue to be exploited in real intrusions.
How It Works
- Input: Starts from the company name, service information, and known domains or IP addresses.
- Asset discovery (inventory): Identifies publicly exposed websites and network devices from the attacker's perspective.
- Stack detection: Determines the system components used by each domain and displays them as tags.
- Vulnerability scanning: Runs scans periodically (such as automatic weekly runs), with ad hoc scans available when needed.
- Risk assessment and prioritization: Evaluates detected vulnerabilities by score and exploit information to decide response order.
- Remediation and verification: Rescans after fixes and returns to updating the asset list, forming a continuous cycle.
Key Features
| Feature | Description |
|---|---|
| Domain inventory | Automatically discovers and lists externally exposed IT assets |
| Automatic stack tagging | Detects and displays components such as AWS, WordPress, rental servers, network devices, and CDN |
| Automatic WAF detection | Identifies the WAF product in use and displays a "WAF" tag |
| Vulnerability scan results | Review detected vulnerabilities by CVSS score and presence of PoC (proof-of-concept code) |
| Detection of specific products | Detects versions and vulnerabilities of products, such as webmail software, with urgent published vulnerabilities |
Features are continuously added and improved. The table above is an example; check the provider's announcements for current coverage.
Reading Results and Prioritizing
ASM produces many findings, so triage is the core of operations rather than "fix everything".
| Perspective | What to check |
|---|---|
| CVSS score | Baseline severity. Does not include environment-specific factors |
| PoC availability | Public exploit code means exploitation is more likely |
| Exposure | Whether it is reachable from the internet without authentication |
| Asset importance | Whether it is close to personal data or core systems, or is a test environment |
| Stack tags | Whether it sits behind a WAF or CDN (a hint of existing mitigation) |
Being protected by a WAF does not mean the vulnerability does not exist. A WAF is a mitigation and not a substitute for root-cause fixes (patching, configuration fixes, or removing unnecessary exposure).
Adoption and Operations
Decide Before Adoption
- Scope: Whether to include your own domains, group companies, and assets operated by contractors
- Authorization: Prior agreement when scanning assets you do not manage (cloud providers, contractors)
- Scan load: Confirm the impact of periodic scans on production (timing, acceptable load)
Operational Cycle
- Review new assets: Assign an owner to each newly discovered unknown asset. Take it offline if unneeded
- Triage vulnerabilities: Create tickets for the responsible teams, starting with the highest priority
- Fix and rescan: Confirm resolution with a rescan after fixing
- Manage exceptions: For findings you will not (or cannot) fix, record the reason, deadline, and compensating controls, and obtain approval
- Review periodically: Track trends in finding counts, mean time to remediate (MTTR), and number of newly found unknown assets
Relationship to Other Vulnerability Measures
| Approach | Target | Strength |
|---|---|---|
| ASM (this document) | All externally exposed assets | Finding unknown assets, continuous monitoring |
| SBOM and Vulnerability Scanning | Dependencies of your own software | Preventing issues during development |
| DevSecOps and Static Analysis | Source code | Early detection of code defects |
| Manual assessment / penetration testing | Individual critical systems | Issues hard to automate, such as logic flaws |
ASM continuously monitors "the surface visible from outside" and complements rather than replaces the other approaches.
Caveats
- False positives and misses are possible: It is based on external observation, so authenticated screens and internal networks are out of scope.
- Detection is not remediation: The tool helps discovery; fixing is your organization's work. Without a remediation flow in place, findings keep piling up.
- Handling sensitive information: Results contain attack-relevant information (a list of vulnerable assets). Limit access to the minimum.
- Sales channels: Besides direct sales by the provider, it may be offered through partners, combined with advisory services (support for remediation and triage).
Summary
- GMO ASM is an ASM tool for inventorying externally exposed IT assets and continuously diagnosing vulnerabilities
- Its value lies in "finding assets you did not know about" and "repeating periodically"
- To get results, you need an operation that prioritizes findings, assigns owners, and drives remediation