Bangladesh's cyber security challenge: Do we know what is exposed?

In Bangladesh, many of us now depend on digital services throughout the day without thinking much about the systems behind them. We send money through mobile financial services, check bank accounts, pay bills, use government services and log in to university or office systems.

The scale is large. Bangladesh Bank data show that mobile financial services handled transactions worth more than Tk 2.16 lakh crore in July 2026, up 45.73 per cent from the same month a year earlier.

All of this depends on digital infrastructure that has to remain connected and available. That raises a question: does the organisation providing the service know exactly what parts of its own infrastructure can be seen from the internet?

Most organisations have a fairly good idea of what sits inside their network. What someone outside can see is harder to answer. Systems are added, moved, upgraded and replaced all the time. Some stay online long after the job they were built for has ended. So over time, what is visible from outside can become much bigger than the list everyone thinks they are protecting.

I spent nearly two decades in network and cyber security in Bangladesh's banking sector. Most of that work was protecting systems we already knew about: networks, firewalls, servers and applications. Today that is not enough. We also have to look at an organisation the way an outsider sees it and ask: what can actually be seen from the internet?

This matters more every year. Government offices, banks, mobile financial services, telecom operators, educational institutions, hospitals and businesses all depend on connected systems. Firewalls and monitoring are still essential. But they work best when an organisation knows what it is putting in front of the world in the first place.

That is where attack surface mapping helps.

Think of a house. The owner knows the front door and locks it every night. But what about the back gate, the old window in the storeroom, the side door nobody has used for years? An attacker only needs one of them.

An attack surface is the same idea for computer systems. It is everything that can be seen or reached from the internet: a public website, a remote-access service, a mail server, a cloud application, or an old system that nobody uses much anymore but is still switched on.

Attack surface mapping means finding all of these and building an honest picture of what an outsider can see. That includes domain names, IP addresses, open services and the software they run.

Being visible does not mean being unsafe. An exposed system is not necessarily weak, and not every weakness gets used by an attacker. The value of mapping is that it gives the security team a better place to start.

It matters because things keep changing. New applications go live, cloud services are added, systems are moved and old ones stay longer than planned. In a big organisation, what is visible from outside can change faster than the internal list of assets.

Mapping does not replace vulnerability assessment, penetration testing, audits or monitoring. It makes them more focused.

Take penetration testing. Testers are normally given an agreed list of systems to test, and anything outside the list is left alone. That is right, because testing must be controlled and authorised. But if a system facing the internet never made it into the inventory, it may never make it into the test either.

Mapping comes first. It shows what is really visible, so testing can focus on the right systems. Red-team exercises go a step further. They use realistic attack scenarios to check whether weaknesses can be used, and also whether the organisation can notice and respond to an attack.

Bangladesh already has cyber security institutions, experienced professionals and ongoing work. BGD e-GOV CIRT, under the Bangladesh Computer Council, is the country's national cyber incident response body and helps protect important digital infrastructure.

Bangladesh Bank has maintained ICT security requirements for the financial sector for years. More recently, it issued BRPD-2 Circular No. 02 on 29 March 2026, introducing the Cybersecurity Framework, Version 1.0 (2026). Regulated financial institutions must comply by 31 December 2026.

So the point is not that Bangladesh has no cyber security controls. That would be unfair and wrong.

The point is that mapping adds one more layer of visibility to the work already being done. Vulnerability assessment, monitoring, risk management and policy all work better when everyone has a clearer picture of what is exposed.

Once an organisation knows what is exposed, the next step is to look for weaknesses: old or unpatched software, wrong settings, known security flaws.

A scan of a large environment can return hundreds or even thousands of findings. That sounds useful. But a long list does not tell the team what to fix first.

That is where the real work begins.

No organisation has unlimited people, time or downtime. Fixes need testing. Important systems cannot always be taken offline. Some updates depend on the vendor. Even a routine fix in a critical system may need careful planning.

So the number of weaknesses tells us very little. A few serious ones on an exposed, important system may deserve far more attention than a long list of minor ones somewhere else. Good security work is not about chasing the biggest number in a report. It is about knowing what matters most.

Penetration testing helps when a team needs to be sure. Can this weakness really be used? How much damage could it do? Would our existing controls stop an attacker?

Three tools help here: CVSS, EPSS and KEV.

CVSS, the Common Vulnerability Scoring System, gives a numerical score for the technical severity of a weakness, commonly grouped as low, medium, high or critical.

But severity is only part of the story. A high score tells us a weakness could do serious damage. It does not tell us how likely attackers are to use it, or how important the affected system is to the organisation.

EPSS, the Exploit Prediction Scoring System, estimates how likely it is that a known weakness will be exploited in the near future. In simple terms, CVSS shows how bad it could be. EPSS shows how likely it is to happen.

KEV, the Known Exploited Vulnerabilities catalogue kept by the US Cybersecurity and Infrastructure Security Agency, lists weaknesses that attackers have already used in real attacks.

No single one of these is enough. The team still has to ask whether the system is open to the internet, how important it is, what service depends on it and what would happen if it were compromised. Only then does a list of weaknesses turn into a real decision.

This is not a problem unique to Bangladesh. Every organisation has limits on how much it can fix at once. But it matters a great deal for a country that depends more on digital services every year.

A risk-based approach focuses on weaknesses that are both serious and likely to be used. Mapping adds one more question: can the affected system actually be reached from the internet? Together, these give a far better basis for deciding what to fix first than simply counting weaknesses.

There is value beyond one organisation too. If this information is handled responsibly, without exposing sensitive details, it can show wider patterns: technologies that keep appearing, the same kinds of exposure repeating, or places where more training and capacity are needed. Bangladesh already has practitioners, researchers, regulators and national institutions working on these issues. Sharing technical information better among them can lead to better decisions.

The benefit reaches beyond security teams. Managers get a clearer view of external risk and where to invest. Auditors can compare what is written in the records with what the outside world can really see.

And the public has a stake.

A cyber incident in a bank can affect customers and financial services. In a hospital, it can affect patients. An attack on government systems can disrupt public services. A problem at a telecom operator can affect every organisation that depends on its network.

A weakness inside one organisation can therefore hurt people far beyond it.

Cyber security will always need firewalls, monitoring, skilled people, vulnerability assessment, penetration testing, red-team exercises where needed and incident response. Attack surface mapping does not replace any of them. Its value is different. It answers a question that is easy to overlook: what is actually exposed?

CVSS, EPSS and KEV are useful too, but only alongside the organisation's own reality. Severity matters. Likelihood matters. Known exploitation matters. So does how important the system is.

As Bangladesh's digital transformation continues, keeping track of what is visible from outside can strengthen the work already being done by institutions, regulators, practitioners and researchers.

The goal is not the longest possible list of weaknesses. It is to understand what is exposed, what really matters and what to fix first.

So alongside asking whether our organisations have policies, firewalls and vulnerability management programmes, there is one more question worth asking regularly: Do we actually know what is exposed?

Knowing the answer is an important step towards protecting what matters most.

* SM Abdul Wadud is pursuing a Master of Cyber Security at the University of Waikato, New Zealand. He has nearly 20 years of professional experience in network and cyber security in Bangladesh's banking sector.