Attack surface

The attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment. The sharp increase of successful attacks in recent years has encouraged the industry to invest more money and time into making their systems free of attack.

Examples of attack vectors include user input fields, , interfaces, and services.

Due to the increase in the countless potential vulnerable points each enterprise has, there has been increasing advantage for hackers and attackers as they only need to find one vulnerable point to succeed in their attack.

According to the white paper of SkyBox Security, there are three steps towards understanding and visualizing an attack surface:

Step 1: Visualize. Visualize the system of an enterprise is the first step, by mapping out all the devices, paths and networks.

Step 2: Find Indicators of Exposures. The second step is to correspond each indicator of a vulnerability being potentially exposed to the visualized map in the last step. One IOE can be "missing security controls in systems and software".

Step 3: Find Indicators of Compromise. This is an indicator that an attack has already succeeded.

The basic strategies of attack surface reduction include the following: reduce the amount of code running, reduce entry points available to untrusted users, and eliminate services requested by relatively few users. One approach to improving information security is to reduce the attack surface of a system or software. By turning off unnecessary functionality, there are fewer security risks. By having less code available to unauthorized actors, there will tend to be fewer failures. Although attack surface reduction helps prevent security failures, it does not mitigate the amount of damage an attacker could inflict once a vulnerability is found.

...
Wikipedia