Attack Surface
5 exercises — master attack surface vocabulary: what the attack surface is and how to reduce it, blast radius analysis, unprotected internal east-west APIs, legacy endpoint risk, and the priority level of privilege minimisation and dependency hygiene.
0 / 5 completed
Attack surface quick reference
- Attack surface — sum of all entry/exit points an attacker can interact with: APIs, ports, inputs, privileged processes, dependencies, admin interfaces.
- Attack surface reduction — remove unused ports/services/endpoints; restrict network access; least privilege; minimise dependencies.
- Blast radius — maximum damage if a component is fully compromised; determined by its IAM permissions, network reachability, and secrets held.
- East-west traffic — internal service-to-service traffic. Without mTLS + authorisation policies, a compromised service can freely call any other internal API.
- Legacy endpoints — no monitoring, outdated auth, no security testing. Security through obscurity is not a control. Audit and remove them.
- Privilege minimisation — least-privilege IAM roles, scoped DB users, no wildcard policies. Limits blast radius of any compromise.
- Dependency hygiene — patch CVEs immediately; use Dependabot/Renovate; maintain SBOM; lock file every project.
1 / 5
A security architect says: "Before we can protect the system, we need to understand our attack surface. What's our attack surface, and why does reducing it matter?"
Attack surface — the attack surface is everything an attacker can interact with. Reducing it is one of the most cost-effective security improvements.
Attack surface categories:
Why attack surface reduction is high-value:
Every removed entry point is a vulnerability you can never have — even if the code behind it had no bugs. Reducing attack surface is different from fixing vulnerabilities: it eliminates entire classes of attacks before they can be attempted.
Internal microservices DO contribute to attack surface:
• Lateral movement: if an attacker compromises one service, internal services reachable from that service become the next stage attack surface
• Supply chain attacks can compromise internal services directly (e.g., a dependency backdoor executing in the internal network)
• Each internal service-to-service call is a lateral movement opportunity; mTLS + service-to-service authorisation reduces internal attack surface
Key vocabulary:
• Attack surface — the sum of all entry/exit points, interfaces, and components an attacker can interact with or exploit
• Attack surface reduction — the practice of removing unnecessary functionality, closing unneeded ports/services, and minimising exposed interfaces
• Entry point — any interface through which an attacker can introduce input into the system
• Lateral movement — an attacker's progression from an initially compromised system to other systems within the network
• Least privilege — granting only the minimum permissions needed to perform a function; reduces the damage of any compromise
Attack surface categories:
| Category | Examples | Reduction strategy |
|---|---|---|
| Network entry points | Open ports, protocols (SMTP, RDP, SSH), load balancer rules | Firewall allowlists; disable unused services; network segmentation |
| Application entry points | REST/GraphQL APIs, form inputs, file uploads, URL parameters | Input validation; rate limiting; authentication on all endpoints |
| Privileged processes | Root processes, SUID binaries, services running as admin | Least privilege; run as low-privilege user; drop capabilities after init |
| Admin / management interfaces | Admin dashboards, SSH, database consoles, cloud management APIs | Restrict to VPN/bastion; MFA; separate admin network |
| Third-party dependencies | npm packages, Docker base images, SDK integrations | Dependency auditing; pin versions; minimal base images |
| Human attack surface | Phishing targets, social engineering, privileged user accounts | Security awareness training; MFA; privileged access workstations |
Why attack surface reduction is high-value:
Every removed entry point is a vulnerability you can never have — even if the code behind it had no bugs. Reducing attack surface is different from fixing vulnerabilities: it eliminates entire classes of attacks before they can be attempted.
Internal microservices DO contribute to attack surface:
• Lateral movement: if an attacker compromises one service, internal services reachable from that service become the next stage attack surface
• Supply chain attacks can compromise internal services directly (e.g., a dependency backdoor executing in the internal network)
• Each internal service-to-service call is a lateral movement opportunity; mTLS + service-to-service authorisation reduces internal attack surface
Key vocabulary:
• Attack surface — the sum of all entry/exit points, interfaces, and components an attacker can interact with or exploit
• Attack surface reduction — the practice of removing unnecessary functionality, closing unneeded ports/services, and minimising exposed interfaces
• Entry point — any interface through which an attacker can introduce input into the system
• Lateral movement — an attacker's progression from an initially compromised system to other systems within the network
• Least privilege — granting only the minimum permissions needed to perform a function; reduces the damage of any compromise