The phrase “Attack Surface” appears in marketing materials, security conversations, and at the start of many Red Team readouts. However, I don’t believe that many people truly understand what it means and how critical it is to risk reduction. Most people would generally agree they want to secure the attack surface, but few can explain what that means. Without the ability to fundamentally understand how organizations’ attack surfaces are the starting point for any attack, we can’t truly protect the most critical assets and correctly layer defense-in-depth. In this post, I’ll lay out the building blocks for talking about attack surfaces and will get into greater detail and specifics about defending them in later briefs.

What is an attack surface?

An attack surface, by my definition, is the parts of the organization (people, processes, or technology) that are exposed to risk. A simple example is a server running a company website (on port 80 or 443, the common ports for hosting web servers), which presents an adversary the opportunity to identify vulnerabilities. Ideally, you would want to continuously scan and patch those vulnerabilities before that exposed surface is exploited. I would also consider mail servers and the inboxes where a phishing email could land as attack surfaces. Depending on what you’re threat modeling, the security guard at the front desk could also be considered an attack surface. Anywhere that an adversary could start an attack, and your organization is exposed to the start of that attack, in my opinion, is an attack surface.

Industry definitions of attack surface:

• What is an attack surface?
• What is an attack surface, and why is it important?
• What is the Difference Between Attack Surface and Threat Surface?

Types of attack surfaces

As a Red Teamer, I view attack surfaces from the position I need to be in to carry out an attack against them. The difference is worth noting because you may want to assess an attack surface even if you feel confident that it would be difficult for an adversary to position themselves to target it. To simplify the overall evaluation of attack surfaces, I will split them into 3 types, which you can review below.

Types of attack surfaces:

• Public – Accessible to any individual on the public internet
• Internal – Accessible by most employees (e.g., requires VPN to access remotely)
• Restricted – Accessible to only authorized employees (e.g., a restricted network)

Each of these attack surface types should be managed differently. There are common misunderstandings and misconceptions of each that I will go into greater detail about below.

PUblic Attack surface

Public means everybody has access 24/7/365, which presents the most immediate and constant risk to an organization. A good example is that if a vulnerability in the technology you run is disclosed, you’re immediately exposed. Response times and SLA (Service Level Agreements) should always reflect this. The ability for adversaries to leverage artificial intelligence has drastically reduced the time needed to exploit exposed vulnerabilities and misconfigurations (see zerodayclock.com). Examples of public attack surfaces include company websites, services, and source code accessible to anyone.

Internal attack surface

Internal can have many meanings, but to most organizations, it means protected from public access. Many organizations achieve this by allowing only on-site (in the building) or remote employees with a VPN (Virtual Private Network) to access internal network resources. One of the most misunderstood beliefs about internal networks is that they’re “secure” or “free from attacks.” In my experience, exploiting a single weakly configured asset on the public attack surface, or a successful phishing attack followed by the deployment of command-and-control software (a tool that grants long-term access to the system), can quickly turn your “internal network” into an open door for an adversary or Red Team. Red Team operations in the style of “assumed compromise” (started internally with the assumption that at some point your internal network could be breached) are run in mature organizations to test how well you can defend your organization when the eventual reality is realized that some weakness will lead to internal access. Examples of internal attack surface include wikis, databases, and closed-source software.

Restricted attack surface

Restricted networks are those that house the most important assets. Networks accessible only to authorized employees. In some cases, these are mandated by compliance, but in others, the organization has self-imposed a high level of security to protect a critical piece of data or service. Usually, the requirement to patch and perform security testing on these networks is a high priority. Even so, we should not consider these unbreachable environments. With enough time and motivation, skilled adversaries can reach these networks. They should be thoroughly security tested (penetration testing, code reviewed, and Red Teamed) annually to ensure the highest level of security. Where this is done, I’ve firsthand experienced how exceptionally difficult it can be to succeed in a Red Team exercise. Where gaps are identified, detections should be built custom to protect these environments.

ATtack surface complexity

Those are the building blocks we need to start the conversation. In theory, defending attack surfaces is straightforward. However, when they scale up to thousands or millions of assets, complexity arises. Managing assets, monitoring lifecycles, and truly understanding where your risk is highest becomes difficult. Attack Surface complexity is where Red Teams and Adversaries thrive. We focus only on the assets that can help us reach our objectives. However, within the organization, where the focus is sometimes on theoretical risk (“an attacker could”), we tend to forget how it all fits together. In future posts, I will help you understand how Red Teams identify the 0.01% of assets that pose the greatest risk to your entire organization and could lead to devastating breaches if left unaddressed.

You can look forward to more content about Attack Surfaces in the future…