Attack surface

The attack surface of a software environment is the sum of the different points (for "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment.[1][2] Keeping the attack surface as small as possible is a basic security measure.[3]

Examples of attack vectors

There are over 100 attack vectors and breach methods that hackers can use. However, some are more common than others. Here are some of the most common attack vectors:[4]

  • Compromised credentials
  • Weak and stolen passwords
  • Malicious insiders
  • Missing or poor encryption
  • Misconfiguration
  • Ransomware
  • Phishing
  • Trust relationships
  • Zero-day vulnerabilities
  • Brute force attack
  • Distributed Denial of Service (DDoS)
Main article: Vector (malware)

Attack vectors include user input fields, protocols, interfaces, and services.

Understanding an attack surface

Due to the increase in the countless potential vulnerable points each enterprise has, there has been increasing advantage for hackers and attackers as they only need to find one vulnerable point to succeed in their attack.[5]

There are three steps towards understanding and visualizing an attack surface:

Step 1: Visualize. Visualising the system of an enterprise is the first step, by mapping out all the devices, paths and networks.[5]

Step 2: Find indicators of exposures. The second step is to correspond each indicator of a vulnerability being potentially exposed to the visualized map in the last step. IOEs include "missing security controls in systems and software".[5]

Step 3: Find indicators of compromise. This is an indicator that an attack has already succeeded.[5]

Surface reduction

One approach to improving information security is to reduce the attack surface of a system or software. The basic strategies of attack surface reduction include the following: reduce the amount of code running, reduce entry points available to untrusted users, and eliminate services requested by relatively few users. By having less code available to unauthorized actors, there will tend to be fewer failures. By turning off unnecessary functionality, there are fewer security risks. Although attack surface reduction helps prevent security failures, it does not mitigate the amount of damage an attacker could inflict once a vulnerability is found.[6]

gollark: I prefer pyrogecko.
gollark: Those who kill geckos may be subject to ***orbital laser strike***.
gollark: MURDERER!
gollark: IfPFAtMDaPIUStL for short.
gollark: It's on my list of "things I am vaguely interested in but am not doing much about".

See also

References
  1. "Attack Surface Analysis Cheat Sheet". Open Web Application Security Project. Retrieved 30 October 2013.
  2. Manadhata, Pratyusa (2008). An Attack Surface Metric (PDF).
  3. Manadhata, Pratyusa; Wing, Jeannette M. "Measuring a System's Attack Surface" (PDF). Cite journal requires |journal= (help)
  4. "8 Common Cyber Attack Vectors and Breach Methods". Balbix. 2019-11-27. Retrieved 2020-07-12.
  5. Friedman, Jon (March 2016). "Attack your Attack Surface" (PDF). skyboxsecurity.com. Retrieved March 6, 2017.
  6. Michael, Howard. "Mitigate Security Risks by Minimizing the Code You Expose to Untrusted Users". Microsoft. Retrieved 30 October 2013.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.