Attack surfaces are where most cyber attacks originate, simply because they’re the entire area of a system or network that hackers try to exploit to gain unauthorized access. Modern attack surfaces’ ever-expanding and dynamic nature make them harder to define and defend: Corporate resources constantly connect to new devices.

Access is continuously being provisioned for business partners, employees, and contractors. Businesses rely increasingly on third-party code and apps to get their work done. And everyone’s IT infrastructure is expanding to the cloud. It’s no wonder organizations find managing risks from the systems, individuals, and applications connected to their network a dizzying task.

But while attack surface management is not easy, you can use many actionable strategies to reduce your attack surface and make it more manageable. This article goes beyond the established wisdom and provides five additional ways to reduce your attack surface that you perhaps haven’t considered before.

The different types of attack surface

Discussions about the cyber attack surface often focus on its digital elements; the systems, apps, and network infrastructure that comprise an organization’s IT ecosystem. Limiting your focus to securing the digital attack surface is risky, considering there are other types of attack surface you should also be aware of, including:

• The social engineering attack surface is the total of people accessing your IT environment (employees, contractors, partners) and their susceptibility to social engineering attacks, such as phishing or tailgating.
• The physical attack surface is the full range of endpoint devices connected to your network that malicious actors could access and exploit to gain entry into your IT environment. The physical attack surface includes employee laptops, on-premise workstations, USB ports, printers, IoT devices, servers, and more.

Some sources add to this vocabulary by defining other attack surfaces, including IoT and AI. However, these are not established definitions, and both arguably form a part of an organization’s physical and digital attack surfaces.

Attack vectors 101

An attack vector is a path a malicious actor takes to exploit some weakness or vulnerability in your surface. As organizations’ IT ecosystems expand, there are more possible paths for unauthorized access unless the attack surface is appropriately managed and reduced. Some of the main attack vectors used by today’s threat actors include:

• Vulnerable web components could mean risky third-party code that powers a specific function on your website, a poorly coded web app, an expired SSL certificate, or a weak open-source library/framework.
• Phishing emails—employees lacking cybersecurity awareness may get duped by emails convincing them to install a trojan horse or reveal sensitive credentials that let a hacker in.
• Weak or stolen credentials—users could set weak passwords that hackers can easily guess using manual or automated methods. At the same time, the dark web is awash with 24 billion stolen credentials that can be reused to hack into networks and apps.
• Malware—malicious code can exploit attack surface weaknesses in several ways, from drive-by downloads at malicious URLs that users click on to users plugging a USB containing a virus or worm into a network endpoint.
• Misconfiguration exploits—IT users can provision cloud infrastructure with just a few mouse clicks, and it’s becoming increasingly common for threat actors to exploit misconfigurations in this infrastructure. The exploits that prey on misconfigurations include searching for unsecured cloud storage buckets, targeting API vulnerabilities, and more.

Securing Your Online Presence

Keep your online businesses safe by mitigating security and privacy risks resulting from next generation third-party threats on your website, without adding a single line of code.

Free Reflectiz Information Kit

Get first-hand information and use cases to discover how Reflectiz can protect your website from advanced third party based attacks

Get Web Asset Free Assessment

Request a free non-intrusive security assessment of your website, and get a report with an overview of client-side security risks.