Attack Surface Management
Understanding and Reducing Your Exposure to Threats
Section 1 of 4
0% Complete
What is Attack Surface?
The attack surface is the sum of all points where an unauthorized user (attacker) can try to enter or extract data from an environment. The larger your attack surface, the more opportunities attackers have.
External Attack Surface
Assets exposed to the internet that attackers can discover and target from anywhere in the world.
- Public websites
- APIs & web services
- Email servers
- VPN gateways
- Cloud services
- DNS records
- SSL certificates
- Public IPs
Internal Attack Surface
Assets accessible from within the network, exploitable after initial compromise or by insiders.
- Workstations
- Servers
- Databases
- Network devices
- Printers/IoT
- User accounts
- Applications
- File shares
Why SOC Analysts Care About Attack Surface
- Every exposed asset is a potential entry point for attackers
- Unknown assets can't be monitored or defended
- Reducing attack surface reduces alert volume and risk
- ASM findings inform threat hunting and prioritization
Attack Surface Components
| Component | Description | Risk Factor |
|---|---|---|
| Open Ports | Network services listening for connections | High |
| Web Applications | HTTP/HTTPS endpoints with user input | Critical |
| User Accounts | Authentication endpoints and credentials | High |
| Third-Party Code | Libraries, APIs, and supply chain dependencies | Medium |
| Physical Access | Building entry, USB ports, console access | Low |