S02E04
What Is an Attack Surface?
An attack surface consists of every point where an unauthorized person could attempt to enter a system, manipulate its operation, or extract information. Certification questions may describe a growing environment and ask which action most effectively reduces its attack surface. Accounts, endpoints, applications, open ports, cloud services, programming interfaces, remote-access tools, vendors, and employees can all create possible paths of attack. Installing unnecessary software or leaving inactive accounts enabled expands the attack surface even when those resources are not actively used. Organizations reduce exposure by removing unneeded services, closing ports, limiting privileges, consolidating systems, reviewing vendors, patching assets, and maintaining an accurate inventory of accessible resources. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!
Related Cyber Wiki
Continue with the concepts discussed in this episode.
Attack Paths
An attack path is a sequence of reachable systems, identities, trust relationships, weaknesses, and actions that could let an adversary move from an initial foothold to a valuable objective.
Threat terminologyAttack Vectors
An attack vector is the route, method, or mechanism an adversary uses to reach a target and attempt an unauthorized action.
Risk terminologyExposure
Exposure is the condition of being reachable, visible, accessible, or otherwise subject to loss or attack because assets, identities, data, or services are presented to a threat.