Attack surface

NIST defines the attack surface as the set of points on the boundary of a system, a system element or an environment where an attacker can try to enter, cause an effect on, or extract data from it. In practice it is usually split into a digital surface (network services, web applications and APIs, remote-access gateways, cloud storage, identity endpoints), a physical surface (devices, ports, premises) and a human or social-engineering surface (staff, help desk, suppliers with access). Software supply-chain dependencies and third-party SaaS integrations have become a fourth category, because a compromised OAuth grant or build dependency reaches inside the boundary without touching any exposed port.

Attempts to measure it go back to Michael Howard's Relative Attack Surface Quotient at Microsoft in the early 2000s, which counted and weighted "attack vectors" such as open sockets, services running as SYSTEM and weak ACLs. Manadhata and Wing later formalised a metric along three dimensions: entry and exit points (methods that receive or send data), channels (sockets, pipes, RPC endpoints) and untrusted data items (files, registry keys, database rows), each weighted by a damage-potential-to-effort ratio. The useful insight is that surface is not just a count of ports; a single endpoint running with high privilege or accepting unauthenticated input weighs more than ten read-only ones.

Operationally, external attack surface management (EASM) discovers what is actually exposed from the outside using DNS enumeration, certificate transparency logs, internet-wide scan data and cloud provider inventories, then compares it with the CMDB. Typical findings are forgotten subdomains vulnerable to takeover, test environments with production data, exposed RDP or management interfaces, and storage buckets with public read. Internally, attack surface analysis in a design review lists entry points per trust boundary, which feeds directly into threat modelling.

Reduction follows a few principles: remove what is not needed (hardening, decommissioning), restrict who can reach what remains (network segmentation, allowlists, authentication in front of admin interfaces), and lower the privilege behind each entry point. A common misconception is that few known CVEs means a small surface; vulnerabilities are defects in the surface, not the surface itself, and an unpatched service that nobody knows exists is invisible to vulnerability scanning scoped to known assets. The attack surface is also distinct from the threat landscape: one describes your own exposure, the other the actors and techniques that may exploit it.