{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/attack-surface","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/attack-surface/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/attack-surface/"},"term":{"en":"Attack surface","da":"Angrebsflade"},"aka":{"en":[],"da":[]},"domain":["security"],"cluster":"application-security","status":"current","summary":{"en":"The sum of all the places where an outsider could try to get into a system, send data into it or pull data out.","da":"Summen af alle de steder, hvor en udefrakommende kan forsøge at komme ind i et system, sende data ind eller hente data ud."},"body":{"formal":{"en":"The set of all points at which a system can be reached or acted on from outside its trust boundary - open ports, web pages and APIs, user accounts, stored data, the people who run it and the suppliers it depends on.","da":"Alle de punkter, hvor et system kan nås eller påvirkes fra den anden side af dets tillidsgrænse - åbne porte, websider og API'er, brugerkonti, lagrede data, de mennesker, der driver det, og de leverandører, det afhænger af."},"plain":{"en":"Like counting every door, window, hatch and mail slot in a house - each one is a place a burglar could try, whether or not it is locked.","da":"Som at tælle hver dør, hvert vindue, hver luge og hver brevsprække i et hus - alle er steder, en indbrudstyv kan prøve, uanset om de er låst."},"inPractice":{"en":"An IT operations manager at a water utility checks what it exposes to the internet and finds an old test website, a forgotten file server and three admin accounts nobody uses; shutting them down shrinks the attack surface.","da":"En IT-driftsansvarlig på et vandværk gennemgår, hvad værket har liggende ud mod internettet, og finder et gammelt testwebsite, en glemt filserver og tre administratorkonti, som ingen bruger; når de lukkes, bliver angrebsfladen mindre."},"whyItMatters":{"en":"Every extra way in is one more thing to watch and patch, and attackers need to find only the one that was missed; a smaller surface leaves fewer places for weaknesses to hide.","da":"Hver ekstra vej ind er én ting mere at holde øje med og patche, og en angriber skal kun finde den ene, der blev overset; en mindre flade giver færre steder, hvor svagheder kan gemme sig."}},"deepDive":{"en":"NIST defines the attack surface as the set of points on the boundary of a system, a system element or an environment where an attacker can try to enter, cause an effect on, or extract data from it. In practice it is usually split into a digital surface (network services, web applications and APIs, remote-access gateways, cloud storage, identity endpoints), a physical surface (devices, ports, premises) and a human or social-engineering surface (staff, help desk, suppliers with access). Software supply-chain dependencies and third-party SaaS integrations have become a fourth category, because a compromised OAuth grant or build dependency reaches inside the boundary without touching any exposed port.\n\nAttempts to measure it go back to Michael Howard's Relative Attack Surface Quotient at Microsoft in the early 2000s, which counted and weighted \"attack vectors\" such as open sockets, services running as SYSTEM and weak ACLs. Manadhata and Wing later formalised a metric along three dimensions: entry and exit points (methods that receive or send data), channels (sockets, pipes, RPC endpoints) and untrusted data items (files, registry keys, database rows), each weighted by a damage-potential-to-effort ratio. The useful insight is that surface is not just a count of ports; a single endpoint running with high privilege or accepting unauthenticated input weighs more than ten read-only ones.\n\nOperationally, external attack surface management (EASM) discovers what is actually exposed from the outside using DNS enumeration, certificate transparency logs, internet-wide scan data and cloud provider inventories, then compares it with the CMDB. Typical findings are forgotten subdomains vulnerable to takeover, test environments with production data, exposed RDP or management interfaces, and storage buckets with public read. Internally, attack surface analysis in a design review lists entry points per trust boundary, which feeds directly into threat modelling.\n\nReduction follows a few principles: remove what is not needed (hardening, decommissioning), restrict who can reach what remains (network segmentation, allowlists, authentication in front of admin interfaces), and lower the privilege behind each entry point. A common misconception is that few known CVEs means a small surface; vulnerabilities are defects in the surface, not the surface itself, and an unpatched service that nobody knows exists is invisible to vulnerability scanning scoped to known assets. The attack surface is also distinct from the threat landscape: one describes your own exposure, the other the actors and techniques that may exploit it.","da":"NIST definerer angrebsfladen som de punkter på grænsen af et system, et systemelement eller et miljø, hvor en angriber kan forsøge at komme ind, påvirke det eller trække data ud. I praksis deles den typisk i en digital flade (netværkstjenester, webapplikationer og API'er, fjernadgangsgateways, cloudlagring, identitetsendpoints), en fysisk flade (enheder, porte, lokaler) og en menneskelig flade til social engineering (medarbejdere, servicedesk, leverandører med adgang). Afhængigheder i softwareforsyningskæden og SaaS-integrationer er blevet en fjerde kategori, fordi et kompromitteret OAuth-samtykke eller en build-afhængighed når ind bag grænsen uden at røre en eneste åben port.\n\nForsøg på at måle fladen går tilbage til Michael Howards Relative Attack Surface Quotient hos Microsoft i begyndelsen af 2000'erne, der talte og vægtede \"angrebsvektorer\" som åbne sockets, tjenester, der kører som SYSTEM, og svage ACL'er. Manadhata og Wing formaliserede senere et mål i tre dimensioner: indgangs- og udgangspunkter (metoder, der modtager eller sender data), kanaler (sockets, pipes, RPC-endpoints) og ubetroede dataelementer (filer, registreringsnøgler, databaserækker), hver vægtet efter forholdet mellem skadespotentiale og indsats. Pointen er, at fladen ikke blot er et antal porte; ét endpoint, der kører med høje rettigheder eller tager imod uautentificeret input, vejer mere end ti skrivebeskyttede.\n\nI driften bruges external attack surface management (EASM) til at finde ud af, hvad der faktisk er eksponeret udefra, via DNS-opslag, certificate transparency-logs, internetdækkende scanningsdata og cloududbydernes inventarer, som så sammenlignes med CMDB'en. Typiske fund er glemte subdomæner, der kan overtages, testmiljøer med produktionsdata, eksponeret RDP eller administrationsflader og lagerbuckets med offentlig læseadgang. Internt bruges angrebsfladeanalyse i designgennemgange til at liste indgangspunkter pr. tillidsgrænse, hvilket fødes direkte ind i trusselsmodelleringen.\n\nReduktion følger få principper: fjern det, der ikke er brug for (hærdning, udfasning), begræns, hvem der kan nå det, der er tilbage (segmentering, allowlists, autentificering foran administrationsflader), og sænk rettighederne bag hvert indgangspunkt. En udbredt misforståelse er, at få CVE'er betyder en lille flade; sårbarheder er fejl i fladen, ikke selve fladen, og en upatchet tjeneste, som ingen kender til, er usynlig for sårbarhedsscanning, der kun dækker kendte aktiver. Angrebsfladen er også noget andet end trusselsbilledet: den ene beskriver ens egen eksponering, det andet de aktører og teknikker, der kan udnytte den."},"edges":[{"type":"requires","to":"security/asset","confidence":"high","strength":"normal"},{"type":"requires","to":"security/vulnerability","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/threat-landscape","why":{"en":"The attack surface is your own ways in; the threat landscape is who and what is out there trying them.","da":"Angrebsfladen er ens egne veje ind; trusselsbilledet er, hvem og hvad der derude forsøger at bruge dem."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/hardening","why":{"en":"Hardening is the main way to shrink the attack surface, by turning off and removing what is not needed.","da":"Hærdning er den vigtigste måde at gøre angrebsfladen mindre på - man slår det unødvendige fra og fjerner det."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/threat-modelling","why":{"en":"Mapping the attack surface shows where threats can enter, which is where threat modelling looks first.","da":"En kortlægning af angrebsfladen viser, hvor trusler kan komme ind, og det er dér, trusselsmodellering kigger først."},"confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"NIST Glossary - Attack Surface","url":"https://csrc.nist.gov/glossary/term/attack_surface","tier":"standard","publisher":"NIST"},{"title":"OWASP Cheat Sheet Series - Attack Surface Analysis","url":"https://cheatsheetseries.owasp.org/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.html","tier":"reference","publisher":"OWASP"}],"draft":true}