Minimise the Attack Surface: Reduce the Opportunities for Attack

Every system an organisation operates potentially provides an opportunity for an attacker.

  • A web server exposed to the Internet.
  • An employee’s laptop.
  • A VPN gateway.
  • An email account.
  • A cloud storage bucket.
  • A database.
  • A forgotten server running an old application.
  • Even a service that nobody uses anymore can become a security problem if it remains connected to the organisation’s environment.

The more systems, services, applications, accounts and connections an organisation has, the more opportunities an attacker potentially has to find a weakness.

This collection of potential opportunities is known as the attack surface.

One of the fundamental principles of cybersecurity is therefore:

Minimise the attack surface by reducing unnecessary systems, services, access, connections and functionality that could be exploited by an attacker.

The idea is simple – If something doesn’t need to exist, don’t expose it.

And if it does need to exist – Expose only what is necessary and protect it appropriately.

What is an Attack Surface?

The attack surface is the collection of points through which an attacker could potentially interact with, compromise or gain access to an organisation’s systems and information.

In an organisation, this can be a huge set of things, including:

  • Internet-facing servers
  • Websites
  • APIs
  • Applications
  • Network devices
  • Remote-access systems
  • Endpoints
  • User accounts
  • Privileged accounts
  • Cloud services
  • Databases
  • Email systems
  • Third-party services
  • Physical access points
  • Wireless networks
  • Software interfaces

It isn’t necessarily a physical surface.

It is better thought of as Everything an attacker could potentially interact with or exploit.

A simple example

Imagine an organisation has one Internet-facing web server.

There is one obvious externally accessible system – the web server

Now imagine the organisation also exposes:

  • Web Server
  • VPN endpoint
  • Remote Desktop services
  • Email Gateway
  • Various APIs
  • Cloud Storage
  • Management Interface
  • OT systems

There are now many more potential entry points and each one needs to be:

  • Properly configured
  • Patched
  • Monitored
  • Authenticated
  • Protected
  • Tested

If just one of them is forgotten, poorly configured or vulnerable, it may provide an attacker with an opportunity for exploitation.

This is why reducing unnecessary exposure is such an important security principle.

Attack Surface vs Attack Vector

These terms are often confused. They are related, but they describe different things.

  • Attack surface describes the collection of potential opportunities an attacker could exploit.
  • Attack vector describes the particular method used to exploit one of those opportunities.

For example:

A phishing email is an attack vector, whereas the organisation’s email infrastructure and user accounts form part of its attack surface.

Reducing the attack surface reduces the number of opportunities available to an attacker.

Why minimise the attack surface?

Every additional system introduces potential risk.

This doesn’t mean every system is insecure – it means every system requires security management.

For example, an organisation might operate 500 servers.

Each server potentially needs:

  • Patching
  • Vulnerability management
  • Configuration management
  • Monitoring
  • Access control
  • Backup
  • Incident response

If 100 of those servers are no longer required but remain online, the organisation is maintaining unnecessary security exposure. Removing them reduces the attack surface, but it also reduces:

  • Administrative overhead
  • Patching requirements
  • Monitoring requirements
  • Vulnerability exposure
  • Potential entry points

This is one of the rare security improvements that can also make an environment simpler and cheaper to operate.

The principle of necessity

A useful question when examining an environment is “Does this actually need to exist?”

For example:

  • Does this server still need to be running?
  • Does this application still need to be installed?
  • Does this port need to be open?
  • Does this service need to be accessible from the Internet?
  • Does this user still need this account?
  • Does this administrator still need this privilege?
  • Does this API need to be publicly accessible?
  • Does this old VPN account still need to exist?
  • Does this unused cloud resource need to remain deployed?

If the answer to any of these questions is no, removing it can eliminate an attack opportunity entirely.

Remove what you don’t need

One of the simplest ways to reduce attack surface is to remove unnecessary components.

This can include:

  • Unused servers
  • Unused applications
  • Unused network services
  • Unused accounts
  • Unused APIs
  • Unused cloud resources
  • Unused software
  • Unused network connections

By doing this, the organisation has eliminated several potential attack paths.

No security product was required – the attack surface was simply made smaller.

Disable unnecessary services

Sometimes a system is required, but not all of its functionality is.

So, for example, a server might run:

  • Web services
  • FTP
  • SSH
  • Database services
  • Remote administration
  • File sharing

If the server only needs to provide a web application, there may be no reason to expose all those other services.

So, a more secure configuration might be:

HTTPS        ✓
SSH          ✓ Restricted
FTP          ✗
Telnet       ✗
Unused DB    ✗
File Sharing ✗

Every unnecessary service that is disabled represents one less potential avenue for attack.

This is sometimes referred to as service minimisation.

Close unnecessary ports

Network services generally listen on ports. An Internet-facing server might have several open ports.

For example:

Port 22 = SSH
Port 80 = HTTP
Port 443 = HTTPS
Port 3306 = MySQL Database
Port 3389 = Remote Desktop Protocol

If the server only needs HTTPS, exposing the other services may be unnecessary, so it is advised to disable all ports apart from 443

The fewer externally accessible services, the fewer opportunities an attacker has to interact with the system.

This is one reason network firewalls often use a default-deny approach.

Remove unnecessary software

Every application installed on a computer potentially adds:

  • Code
  • Dependencies
  • Services
  • Configuration
  • Vulnerabilities
  • Update requirements

If software isn’t needed, removing it can reduce the attack surface.

This applies particularly to servers. A server that runs only the software necessary for its function is generally easier to:

  • Secure
  • Patch
  • Monitor
  • Configure
  • Audit

This principle is sometimes described as minimising functionality.

Secure configuration

Attack surface reduction isn’t only about removing systems – It can also involve reducing what existing systems expose.

For example, an application may have administrative functionality. So, rather than exposing that interface to the entire Internet, it could be:

  • Restricted to administrators
  • Placed behind a VPN
  • Protected by MFA
  • Restricted by IP address
  • Accessible only through a management network

The application still exists, but its exposed attack surface has been reduced.

Internet exposure

One of the most important areas to consider is Internet-facing infrastructure. An Internet-facing system is potentially reachable by attackers anywhere in the world. The Internet is a very hostile place for services to exist.

The organisation should ask Does this service actually need to be accessible from the Internet?

If not, it can potentially be moved behind another security boundary such as a firewall or VPN so it is no longer directly exposed to the Internet.

Network segmentation

Network segmentation is another way to reduce attack surface. Instead of allowing every system to communicate with every other system, organisations can restrict communication to what is actually required.

An attacker who compromises a user workstation therefore has fewer systems available to attack directly.

This is particularly important for limiting lateral movement.

Attack surface and lateral movement

Attack surface isn’t just about how an attacker gets into an organisation – It also concerns what they can reach after they get in.

Imagine a compromised laptop. Every service that laptop is allowed to interact with is now within reach of the attacker

  • File Servers
  • Email Servers
  • Database servers
  • Backup systems
  • Domain controllers
  • Management systems

The attacker has a large internal attack surface.

But if we introduce segmentation and access controls, then direct access to those services is limited

The initial compromise hasn’t necessarily been prevented, but the number of systems available to the attacker has been dramatically reduced.

User accounts are part of the attack surface

People are also part of the attack surface. Every user account can potentially be:

  • Compromised
  • Phished
  • Abused
  • Misconfigured
  • Given excessive privileges

An organisation with thousands of unnecessary accounts has a larger identity attack surface than one that regularly removes obsolete accounts.

This makes joiner, mover and leaver processes particularly important.

  • When someone leaves an organisation, their accounts should be disabled or removed.
  • When someone changes role, unnecessary permissions should be removed.

Privileged accounts

Privileged accounts deserve particular attention – A normal user account may provide access to a handful of business applications, but a domain administrator account might provide access to almost everything.

From an attacker’s perspective, these accounts are extremely valuable.

Reducing the privileged attack surface can involve:

  • Removing unnecessary administrator accounts
  • Using separate standard and administrative accounts
  • Limiting administrator permissions
  • Using Privileged Access Management
  • Using Just-in-Time privileges
  • Monitoring privileged activity
  • Protecting privileged credentials

The objective is to minimise the number of accounts capable of causing significant damage.

Cloud attack surface

Cloud environments can create enormous attack surfaces.

Organisations may have:

  • Virtual machines
  • Containers
  • Storage buckets
  • Databases
  • APIs
  • Serverless functions
  • Cloud identities
  • Network interfaces
  • Security groups
  • Third-party integrations

A resource that is accidentally exposed to the Internet can potentially become an attack opportunity.

Cloud environments therefore require continuous visibility into what is exposed and why.

APIs are part of the attack surface

Modern applications often expose Application Programming Interfaces (APIs.)

Every API endpoint potentially adds functionality that needs to be secured.

Attack surface reduction might involve:

  • Removing unused endpoints
  • Restricting access
  • Requiring authentication
  • Applying authorization
  • Rate limiting
  • Validating input
  • Restricting administrative APIs
  • Monitoring API activity

An API shouldn’t expose functionality simply because “We might need it later.”

If it isn’t required, it may be better not to expose it at all.

Third-party services

An organisation’s attack surface isn’t limited to systems it owns itself. Third-party services can also create exposure.

Each connection to a third-party service or system creates some degree of dependency and potential risk.

Organisations should therefore understand:

  • What third parties have access
  • What systems they can access
  • What information they can access
  • Why they need that access
  • Whether the access is still required

Removing unnecessary third-party integrations can reduce attack surface just as removing an unused internal service can.

Physical attack surface

The attack surface isn’t exclusively digital. Physical access points can also create opportunities for attack.

Examples include:

  • Server rooms
  • Network cabinets
  • USB ports
  • Unattended computers
  • Wireless access points
  • Building entrances
  • Printers
  • Removable media

For example, an unused network port in a public area could provide an attacker with a physical connection to the internal network.

Organisations can reduce this attack surface through:

  • Port security
  • Physical locks
  • Access control
  • Disabled unused ports
  • Device encryption
  • Secure equipment storage

Cybersecurity and physical security therefore overlap.

Attack surface management

Large organisations cannot manually inspect every system every day. They therefore need Attack Surface Management processes and technologies.

These help organisations identify:

  • Internet-facing assets
  • Unknown systems
  • Forgotten services
  • Exposed ports
  • Vulnerable applications
  • Misconfigured cloud resources
  • Unmanaged devices
  • Forgotten domains
  • Shadow IT

One of the biggest challenges is something known as asset visibility – You can’t secure something you don’t know exists.

The problem of unknown assets

Imagine an organisation officially knows about 100 servers.

But an external network scan discovers 117 Internet-facing systems

Where did the other 17 come from?

They might include:

  • Old test systems
  • Forgotten servers
  • Developer infrastructure
  • Temporary systems
  • Third-party services
  • Acquisitions
  • Shadow IT

These unknown assets are particularly dangerous because they may not be included in normal security processes.

They might not be:

  • Patched
  • Monitored
  • Scanned
  • Backed up
  • Properly configured

This creates a known unknown problem.

Attack surface reduction is continuous

Attack surface isn’t something an organisation reduces once and then forgets about – It changes constantly.

  • New systems are deployed.
  • Old systems are forgotten.
  • Employees join and leave.
  • Applications are replaced.
  • Cloud resources are created.
  • Temporary test systems become permanent.
  • New APIs are published.
  • Third-party integrations are added.

The attack surface therefore needs to be continuously reviewed.

This is a continuous cycle.

Minimise rather than eliminate

It is important to understand that an organisation cannot realistically eliminate its attack surface entirely.

A business needs systems to operate.

  • A web company needs websites.
  • Employees need computers.
  • Customers need APIs.
  • Administrators need management interfaces.
  • Businesses need email.

The objective isn’t “Have no attack surface.”, it is more like “Have no unnecessary attack surface.”

That distinction is crucial.

The principle of secure exposure

When something must be exposed, the question becomes “What is the minimum exposure required?”

For example, suppose a web server needs to be publicly accessible.

That doesn’t mean:

Every service on the server should be publicly accessible.

The application is exposed because it needs to be, but unnecessary services should remain restricted.

This is minimising the attack surface rather than eliminating necessary functionality.

Attack surface and least privilege

The principle of least privilege applies directly to attack surface reduction. Every unnecessary permission increases the potential actions available to an attacker.

Removing unnecessary permissions reduces the account’s attack surface.

The same principle applies to applications and services as well.

Attack surface and defence in depth

Attack surface reduction is also an important part of defence in depth.

Remember that defence in depth assumes that some controls will eventually fail, so minimising attack surface reduces the number of opportunities available for those failures to occur.

These principles complement one another.

Attack surface and Zero Trust

Zero Trust also contributes to attack surface reduction – If an application doesn’t automatically trust every user and every system, the effective attack surface becomes smaller.

Zero Trust therefore helps reduce the accessible attack surface.

How organisations minimise attack surface

A practical attack-surface reduction programme can include:

  • Asset discovery – Know what systems and services exist.
  • Remove unnecessary systems – Decommission systems that are no longer required.
  • Disable unnecessary services – Turn off functionality that isn’t needed.
  • Close unnecessary ports – Restrict network exposure.
  • Restrict Internet access – Don’t expose internal services unnecessarily.
  • Segment networks – Prevent unnecessary communication between systems.
  • Remove obsolete accounts – Eliminate unnecessary identity attack paths.
  • Apply least privilege – Reduce what users and applications can do.
  • Restrict administrative interfaces – Don’t expose management systems unnecessarily.
  • Patch and update – Reduce exploitable vulnerabilities in the systems that remain.
  • Monitor continuously – Identify newly exposed or unexpected assets.
  • Review regularly – The attack surface changes as the organisation changes.

In summary

Minimising the attack surface means reducing the number of systems, services, applications, accounts, permissions, connections and interfaces that an attacker could potentially exploit.

It can involve:

  • Removing unnecessary systems
  • Disabling unused services
  • Closing unnecessary ports
  • Restricting Internet exposure
  • Removing obsolete accounts
  • Applying least privilege
  • Segmenting networks
  • Restricting administrative interfaces
  • Securing cloud resources
  • Controlling APIs
  • Managing third-party access
  • Monitoring externally exposed assets

The fundamental principle is:

Every unnecessary system, service, account or connection is another potential opportunity for an attacker.

You cannot eliminate the attack surface completely – An organisation needs technology to operate.

Instead, the objective is to ensure that everything exposed exists for a reason, is appropriately protected and provides only the functionality and access that is actually required.

The most secure attack surface is the one you don’t need to expose in the first place.