Attack Surface Management

Chapter 2. Types of Attack Surfaces

The transformation of IT infrastructure over the years has led to a multifaceted and complex landscape of attack surfaces, blending traditional elements like servers, workstations, and legacy systems with advanced technologies such as cloud computing, IoT devices, AI, and virtualization. This evolution has expanded the scope of IT beyond physical data centers to include virtualized environments, mobile and interconnected devices, and a vast array of cloud-based services and applications.

While this change has enhanced operational flexibility and efficiency, each component introduces unique security challenges and management complexities. This has created a need for new ways to manage security without overloading existing teams or technologies. By understanding these surfaces, we can learn how to find a balance in getting the benefits of these new technologies without applying so much security friction that keeping them safe eliminates their benefits.

The Ever-Expanding Organizational Attack Surface

When we start looking at attack surfaces, it’s no longer as simple as it was in the early days of IT and the internet. We still have all of the traditional components of IT that keep businesses running, including workstations, networks, and servers, but IT is so much more now.

IT and how we do business has expanded to include a wider variety of technologies that are just as integral to business operations as the traditional components. Mobile devices ...