Attack Surface
The total number of points (the 'attack vectors') where an unauthorized user can try to enter data to or extract data from an environment.
Detailed Explanation
Reducing the attack surface is a primary goal of security engineering. This involves disabling unused services, closing unnecessary ports, sanitizing all inputs, and keeping software updated. The smaller the attack surface, the easier it is to defend. Every new feature, API endpoint, or dependency added increases the attack surface.
Quick Summary
Your attack surface is the sum of every place an attacker could try to get in or extract data. The fastest way to be more secure is usually to be smaller, fewer endpoints, ports, dependencies, and privileges.
Key Takeaways
- Three layers: digital (APIs, endpoints, software), physical (devices, ports), and human (phishing, social engineering).
- Every dependency, integration, and feature flag adds attack surface, sometimes silently for years.
- Forgotten subdomains, abandoned services, and stale credentials are favorites for attackers, they're rarely monitored.
- Continuous discovery tools (Censys, Shodan, internal asset inventory) help find what you don't know you have.
- Reducing attack surface is often cheaper than adding new defenses to the surface you've got.
When to use it
- Pre-launch security review: list every external endpoint and ask which can be removed or restricted.
- Post-acquisition due diligence: inheriting another company's surface usually means inheriting their stale infra.
- Dependency hygiene: remove unused packages from `package.json` / `requirements.txt` rather than chasing CVEs in them forever.
- Network segmentation: prevent internal-only services from being internet-reachable.
Common Mistakes
- Treating attack surface as static; it grows with every PR, dependency upgrade, and acquired service.
- Counting only production, staging and dev environments are equally exposed and often less hardened.
- Ignoring third-party SaaS: every integration is part of your surface, even if you don't run the code.
- Forgetting to remove DNS records and S3 buckets when services are retired, subdomain takeover follows.
Attack Surface, Frequently Asked
How do I measure attack surface?
Count externally reachable endpoints, ports, and credentials, then weight by sensitivity. There's no single metric, but periodic external scans (asset discovery) and dependency inventories give a usable baseline you can track over time.
Is a monolith or microservices safer?
Microservices typically expand attack surface (more APIs, more service accounts, more network paths) but contain blast radius better. Monoliths shrink surface but a single compromise touches everything. Choose based on team and threat model, not security alone.