Information Security Management, 2nd Edition

3.2 Attack Surface

Now that we have a general understanding of some of our adversaries and a few of their motives, let’s explore some ways to defend against them. An attack surface comprises the number of ways that an attacker might compromise a network, system, or device. In most companies, this largely consists of the network layers and all of the computing systems, components, and appliances that we call infrastructure. While attack surfaces can vary widely, for instance, the attack surface of a modern automobile is going to be drastically different from a traditional technology service provider, they all share similar characteristics. There are software services, managed by a network and controlled through communication and/or routing protocols. ...