Attack Surface Management

Chapter 3. How the Attack Surface Relates to Risk

A note for Early Release readers

With Early Release ebooks, you get books in their earliest form—the author’s raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 3rd chapter of the final book. The GitHub repo will be made active later on.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

Understanding the relationship between an organization’s attack surface and risk exposure is foundational for protecting valuable assets. This chapter explores the essential role of risk management in cybersecurity, guiding professionals through the various methods of identifying, measuring, and managing risks that endanger their organizations.

In this chapter, we discusses qualitative and quantitative risk assessments and analyzes widely used frameworks such as NIST and ISO. Together we’ll look at practical insights into selecting the right approach for different environments. We’ll dive into prioritizing risks based on impact and likelihood, ensuring that the most consequential vulnerabilities are addressed first. This information will equip you with the tools necessary to translate technical risks into actionable business strategies that non-technical business units can understand and act on. ...