Attack surface
Identify the reachable interfaces and trust relationships that could be misused.
The idea
An attack surface is the set of interfaces, entry points, and relationships through which an adversary might interact with a system. It includes more than open network ports: identities, APIs, administrative paths, third-party integrations, and human workflows matter too. Reduce unnecessary exposure and assign ownership to what remains. An inventory needs updating as deployments and business processes change.
In practice
A public API, password-reset workflow, cloud management role, and support process all create different opportunities for interaction with the organization.
A common misunderstanding
A clean external port scan is not a complete attack-surface assessment.
Check your understanding
What makes an exposure worth prioritizing?
Think it through: Its reachability, privileges, affected assets, likely misuse, and business consequence.
Count relationships as well as addresses
A fictional design studio publishes a customer portal, uses a cloud storage service, and lets support staff reset accounts. An external scan may find the portal, but it will not fully describe delegated cloud access or the support verification process. Those relationships can still provide routes to sensitive actions.
Start from the service and its users. Identify public interfaces, management access, integration credentials, recovery flows, and third parties that can influence the system. For each, ask who can interact with it, what authority it offers, and who owns its maintenance. An abandoned endpoint with no owner is an operational issue as well as an exposure.
Reduction means removing unnecessary opportunities, not making every system unreachable. A public portal must remain reachable to serve customers. Its legitimate surface can be narrowed through supported operations, minimal permissions, current software, and clear ownership. Retiring an unused integration may remove more risk than hiding an already-protected interface behind an obscure URL.
Inventory a fictional customer journey
Draw registration, sign-in, account recovery, document upload, and support contact for the studio. Add the administrative and partner paths behind those features. Record which systems and identities participate in each step. Use this to identify interfaces missing from a network-only inventory.
Revisit the map after deployments, acquisitions, and vendor changes. A one-time inventory becomes stale as products evolve. When prioritizing, combine reachability with authority and business impact; the largest visible interface is not always the most consequential one. A useful attack-surface review produces owned actions, such as retiring an old endpoint or restricting an integration, rather than only a longer list of discovered names.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: Technical Guide to Information Security Testing and Assessment