Attack Surface.

What is an attack surface?

NIST defines an attack surface as the set of points on the boundary of a system, a system component or an environment where an attacker can try to enter, cause an effect on, or extract data from it. Put simply, it is every place where an attacker could try to get in or do harm.

What does it include?

As a general illustration, it can include websites and web applications, login pages, mail servers, remote access tools, cloud services and the accounts that run them. It can also include services run by suppliers, and people, because staff accounts and exposed passwords are other ways in. Security teams often split it into an external part, which can be reached from the internet, and an internal part, which an attacker only reaches after getting in.

Why does it keep growing?

Every new project can add something: a test site, a cloud account, a page for a campaign or a tool for a partner. Systems are often left running after the team that built them has moved on. As a result, a list that was complete last year is often incomplete now. Cloud services can make this harder, because a new one can be started quickly without security hearing about it.

Why does it matter?

You cannot defend what you do not know you have. Each point on the boundary is a place where an attacker can try to enter or take data, so a forgotten system can become the weakest point. A smaller and better known surface gives attackers fewer places to try and gives defenders fewer places to watch. The idea also helps in planning, because it turns a vague worry into a list that can be checked and reduced.

How can you reduce it?

Good practice can follow a simple order:

• Find out what you have, ideally by looking from the outside, as an attacker would.
• Remove what you do not need, such as old sites, unused accounts and unused services.
• Fix the most serious weaknesses on what remains.
• Check again regularly, because the picture changes.

This ongoing work is often called attack surface management.

Is an attack surface the same as a vulnerability?

No. A vulnerability is a weakness in a specific system. The attack surface is the set of places an attacker can reach. A system can be on the attack surface and have no known weakness, and a weakness only matters to outsiders if they can reach it.

Is the attack surface the same as the digital footprint?

They overlap but differ. The digital footprint is the trail of information and assets an organization has online. The attack surface is the part of that picture an attacker can use to try to get in.

Brandefense External Attack Surface Management monitors the external part.

Related pages in the Knowledge Hub

• External Attack Surface Management 101
• Attack surface reduction
• Digital Risk Protection 101