Browse Definitions :
Definition

attack surface

An attack surface is the total sum of vulnerabilities that can be exploited to carry out a security attack. Attack surfaces can be physical or digital. The term attack surface is often confused with the term attack vector, but they are not the same thing. The surface is what is being attacked; the vector is the means by which an intruder gains access. 

Both physical and digital attack surfaces should be limited in size to protect surfaces from anonymous, public access. Organization can analyze and reduce its physical and digital attack surfaces by taking the following measures:

  • Identify physical and digital assets.
  • Conduct an attack surface analysis.
  • Review asset management policies.
  • Eliminate complexity by reducing unused, redundant or overly permissive rules.
  • Prioritize strengthening most vulnerable attack points first.
  • Continually seek ways to make attack surfaces smaller.

Digital attack surfaces

In a computing , a network attack surface is the totality of all vulnerabilities in connected hardware and software. In order to keep the network secure, network administrators must proactively seek ways reduce the number and size of attack surfaces. There is a law of computing that states that the more code you have running on a system, the greater the chance that the system will have an exploitable security vulnerability. This means that one of the most important steps information technology (IT) administrators can take to secure a system is to reduce the amount of code being executed, which helps reduce the software attack surface.

One popular approach to limiting the size of attack surfaces is a strategy called microsegmentation . With microsegmentation , the data center is divided into logical units, each of which has its own unique security policies. The idea is to significantly reduce the surface available for malicious activity and restrict unwanted lateral (east-west) traffic once the perimeter has been penetrated. Policies are tied to logical segments, so any workload migration will also move the security policies.

Network microsegmentation isn't new, but its adoption has been sparked by software-defined networking (SDN) and software-defined data center (SDDC) technologies. Traditional firewalls remain in place to maintain north-south defenses, while microsegmentation significantly limits unwanted communication between east-west workloads within the enterprise.

Physical attack surfaces

In computing, a physical attack surface includes access to all endpoint devices, including desktop systems, laptops, mobile devices, USB ports and improperly discarded hard drives. Once an attacker has accessed a computing device physically, the intruder will look for digital attack surfaces left vulnerable by poor coding, default security setting or poorly-maintained software that has not been updated or patched. The physical attack surface is exploitable through inside threats such as rogue employees, social engineering ploys and intruders posing as service workers, especially in public companies. External threats include password retrieval from carelessly discarded hardware, passwords on sticky notes and physical break-ins.

Physical security has three important components: access control, surveillance and testing. Obstacles should be placed in the way of potential attackers and physical sites should be hardened against accidents, attacks or environmental disasters. Such hardening measures include fencing, locks, access control cards, biometric access control systems and fire suppression systems. Second, physical locations should be monitored using surveillance cameras and notification systems, such as intrusion detection sensors, heat sensors and smoke detectors. Third, disaster recovery policies and procedures should be tested regularly to ensure safety and to reduce the time it takes to recover from disruptive man-made or natural disasters.

 

 

This was last updated in February 2019

Continue Reading About attack surface

SearchCompliance
  • OPSEC (operations security)

    OPSEC (operations security) is a security and risk management process and strategy that classifies information, then determines ...

  • smart contract

    A smart contract is a decentralized application that executes business logic in response to events.

  • compliance risk

    Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting ...

SearchSecurity
  • buffer overflow

    A buffer overflow occurs when a program or process attempts to write more data to a fixed-length block of memory, or buffer, than...

  • biometric verification

    Biometric verification is any means by which a person can be uniquely identified by evaluating one or more distinguishing ...

  • password

    A password is a string of characters used to verify the identity of a user during the authentication process.

SearchHealthIT
SearchDisasterRecovery
  • What is risk mitigation?

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • change control

    Change control is a systematic approach to managing all changes made to a product or system.

  • disaster recovery (DR)

    Disaster recovery (DR) is an organization's ability to respond to and recover from an event that affects business operations.

SearchStorage
  • What is RAID 6?

    RAID 6, also known as double-parity RAID, uses two parity stripes on each disk. It allows for two disk failures within the RAID ...

  • PCIe SSD (PCIe solid-state drive)

    A PCIe SSD (PCIe solid-state drive) is a high-speed expansion card that attaches a computer to its peripherals.

  • VRAM (video RAM)

    VRAM (video RAM) refers to any type of random access memory (RAM) specifically used to store image data for a computer display.

Close