An attack surface is the total set of points where an unauthorized user could try to enter a system, extract data from it, or cause harm.
The attack surface is often used as a rough indicator of how exposed a system is. A smaller attack surface means fewer ways for an attacker to get in, so reducing it is a core principle of secure design. It is worth noting, though, that a smaller attack surface does not reduce the damage an attacker could do once they have already breached the system. It only lowers the number of ways they might get in.
To find a way in, an attacker often needs only one vulnerable point. In more sophisticated attempts, they may first map out a system, list its devices and connections, and then look for weaknesses at each node before choosing where to strike.
Reducing the attack surface is a common way to build more secure systems. Some basic measures that can help include:
Running less code: fewer lines of code generally mean fewer potential attack vectors.
Limiting entry points: fewer ways to access a system tend to leave fewer openings for unauthorized users.
Turning off unnecessary features: disabling services used by only a small number of users removes functionality that attackers could otherwise target.
Applied together, these practices help keep a system leaner and typically more resistant to compromise, though no approach can remove risk entirely.
A mechanism used in computer security used to detect or counteract unauthorized access of information systems.
Computer code, which is responsible for defining how software will function based on a list of instructions...