Attack Surface

Properly securing your network requires a firm understanding of all possible points of entry for an adversary. This is known as an attack surface.

What is an attack surface?

NIST defines an attack surface as “The set of points on the boundary of a system, a system element, or an environment where an attacker can try to enter, cause an effect on, or extract data from, that system, system element, or environment.”

The attack surface should not be confused with an attack vector, which is an individual entry point. However, reducing the number of attack vectors also reduces the size of your attack surface and lowers the risk of a data breach.

Digital versus physical attack surfaces

A network will have two attack surfaces—digital and physical.

Digital attack surfaces

The digital attack surface includes anything that connects to the network. Hardware (servers and switches) and software (applications, websites, ports, and individual pieces of code) are examples.

Physical attack surfaces

Endpoint devices that cyber attackers can gain access to are the most common examples of physical attack surfaces. However, this can also include careless user behavior such as discarded or stolen login information written on a sticky note or other obtainable items like hardware keys or USB drives that disclose login credentials.

Contributors to Attack Surface Size

The size of an organization’s attack surface will depend on the number of devices, or points of entry, on your network. Reducing the number of entry points (vectors), such as eliminating passwords, will reduce your attack surface.

Devices

For a long time, IT administrators only needed to worry about equipment and devices within the walls of their organization. Work from home, an increasingly mobile workforce, and COVID-19 changed that. Users now expect to access company resources outside of the office, and IT administrators were forced to adapt.

Other factors, like the Internet of Things (IoT), only exacerbate the problem. With nearly 30 billion IoT devices expected to be connected to the internet by the end of the decade, combined with inevitable software bugs and vulnerabilities, most organizations’ attack surfaces will grow over the next decade.

User behavior

Many attacks are successful because they exploit employees' often poor security practices. Whether writing credentials on a piece of paper, choosing a weak or reused password, or even attempting to circumvent security measures, organizations are all too familiar with users being the weak point in their cybersecurity efforts.

What is an attack surface analysis?

An attack surface analysis is vital to understanding your vulnerabilities. It will also help you prevent future attacks. Your analysis should:

• Identify any vulnerabilities: As explained, any point of entry, digital or physical, is a weakness attackers can exploit. Carefully review data entry and exit points.
• Know your users and their needs: Each organization will have unique user types, each with specific daily needs.
• Know your risk: With a better understanding of your users, you’ll be able to perform a comprehensive risk assessment. Review and secure your most common operations first.
• Set up monitoring and reporting if necessary: The final step of your analysis is using all you’ve learned to set up real-time monitoring of any potential attack vectors. You should also plan to respond to and comply with any disclosure requirements required by law.

Remember that attack surface analyses are large projects that take weeks or months to complete. While that might be intimidating, you want your analysis to be as thorough as possible.

How to reduce your attack surface

After completing your attack surface analysis, we recommend you consider the following strategies to reduce your attack surface.

• Limit access and permissions: Access management can reduce the attack surface by limiting what a user may have access to while connected to the network. Review access to sensitive information and your logs to determine normal bandwidth usage and access patterns, and adopt zero trust.
• Eliminate passwords: Passwordless authentication uses cryptographic keys, which are unphishable. Each username and password pair is an attack vector, a huge security risk.
• Eliminate complexity: Complex networks can make attack response difficult since you don’t have complete visibility into whom and what is connecting to your network. Begin by inventorying all software, hardware, and access points, and eliminate unnecessary ones. Follow this by adopting centralized identity management.
• Train your employees: Attack surfaces aren’t limited to hardware or software. Human assets and the data they leave behind across the internet adds to this surface. Providing employees and contractors with anti-phishing and social engineering training is one way to limit risk.

How Beyond Identity can help

Beyond Identity’s passwordless MFA combines all of the steps you need to take to reduce attack surface size in a single package we call Secure Workforce. Our platform helps you achieve zero trust by eliminating the password and choosing cryptography and frictionless, invisible MFA over the traditional one-time password or code.

Each key pair is tied to both the user and the device, allowing you to achieve certainty of identity you can’t achieve with the password. Beyond Identity also authenticates the user continuously while monitoring over 25 risk signals of potentially malicious activity.

The best part about Secure Workforce is the ease of integration with the most common authentication platforms, including Auth0, ForgeRock, Microsoft Active Directory, Okta, and Ping Identity, in as little as 30 minutes. Our customers can typically fully deploy Secure Workforce across their organization in 90 days or less.

We’d love to show you how Beyond Identity and Secure Workforce can drastically reduce the size of your attack surface while making authentication seamless, easy, and invisible with passwordless MFA. Ask for a demo today.