What is an attack surface?
An organization's attack surface is every point where an attacker could try to interact with its systems: each open port and running service, each application, API and web form, each user and service account, each remote access gateway, wireless network, cloud resource and partner connection, and each person who could be tricked. Every one of those points is a chance for a vulnerability or a weak credential to be found. The larger the surface, the more there is to patch, monitor and defend.
The attack surface exists whether or not anyone attacks it. Standing up a new internet-facing server enlarges it on day one.
What makes up an attack surface
| Area | Examples |
|---|---|
| Network and services | Open ports, exposed RDP or SSH, VPN appliances, forgotten test servers |
| Applications | Websites, APIs, plugins, third-party libraries |
| Identity | User, service and default accounts, and identity providers that every federated app trusts |
| Cloud | Public storage buckets, open security groups, SaaS tenants |
| Physical | USB ports, network jacks in public areas, unattended devices |
| Human | Staff who can be phished, contractors and visitors with access |
| Third parties | Vendor remote access, managed service provider tools, supplier software |
Attack surface reduction
Attack surface reduction removes the points that serve no business need, so there is less to defend. It works on four things:
- Services and ports: disable or uninstall what isn't used, and bind administrative services to a management interface.
- Accounts: remove default, shared and stale accounts, and disable leavers' accounts promptly.
- Paths: remove broad firewall allow rules, unneeded routes and old VPN tunnels or partner links, and place systems in zones so only named flows cross between them.
- Software: remove unused applications, plugins and features.
An external scan of a web server whose only job is serving customers over HTTPS shows the idea. Running nmap -Pn -p- 203.0.113.20 reports ports 22, 80, 443, 3306 and 3389 open. MySQL on 3306 means a database is answering the internet, and RDP on 3389 is one of the most attacked services there is. After the database moves to a restricted zone and SSH and RDP are allowed only from a jump server, the same scan shows just 80 and 443, with 80 kept only to redirect visitors to HTTPS.
Finding the attack surface you didn't know about
You can't reduce what you can't see. Forgotten cloud instances, shadow IT services, old DNS records and test systems published by a stray port forward are attack surface nobody is defending. An accurate asset inventory, regular external scans of your own address ranges, certificate transparency monitoring for new hostnames, and cloud security posture management all help. Attack surface management services do this continuously, from an attacker's point of view.
Attack surface vs. threat vector vs. vulnerability
The attack surface is everything that could be a route in. A threat vector is the one route an attacker actually uses, such as a phishing email or an exposed RDP port. A vulnerability is a specific weakness on that surface, such as an unpatched plugin. Security work pushes in two directions at once: shrink the surface so there are fewer routes, and defend the vectors that remain. Disabling an unused service is surface reduction; training users to spot a malicious link defends a vector.
Attack surface on the CompTIA Security+ exam
SY0-801 objective 2.4 covers vulnerability types and the attack surfaces they sit on, including newer ones such as identity providers, public code repositories, object storage, mobile devices and wireless. Objective 3.2 covers attack surface reduction as part of managing security architecture, and objective 2.3 tests the difference between a surface and a vector. When a question asks how to reduce the attack surface, the answer removes something: close a port, disable a service, delete an account or cut a path. Adding an IDS improves detection but leaves every port open, and moving SSH to a non-standard port hides it from casual scans without removing it. When a question asks what increased the organization's overall exposure, it is pointing at the attack surface; when it asks how a specific attack arrived, it is pointing at a vector.