Making Sense of External Attack Surface