Attack Surface
What is Attack Surface?
The total number of possible entry points for unauthorised access to a system. Reducing the attack surface through hardening, patching, and removing unnecessary services is a core security practice.
Terms that appear alongside attack surface
Each of these is named in at least one of the same controls as attack surface. The number is how many controls name both.
- hardening 6 shared controls
- mitre 3 shared controls
- reconnaissance 2 shared controls
- least privilege 2 shared controls
- asset inventory 2 shared controls
- cybersecurity 2 shared controls
- encryption 2 shared controls
- integrity 2 shared controls
Frameworks that govern attack surface
What the standards actually require on attack surface
Requirements naming attack surface across 6 standards, quoted from the control text.
Require the developer of the system, system component, or system service to perform attack surface reviews.
NIST800-SA-11(6) · SA-11(6) Developer Testing and Evaluation | Attack Surface Reviews →Isolate ICS networks from any untrusted networks, especially the Internet; lock down all unused ports and turn off all unused services. Allow real-time external connectivity only where there is a defined business or control requirement;
CISA-ICS-7S-3 · Reduce Your Attack Surface Area →The product must be designed, developed and produced to limit attack surfaces, including external interfaces.
eu-cyber-resilience-act::Annex I Part I(2)(j) · Limiting attack surfaces, including external interfaces →Per SWIFT CSCF Objective 2: Internal Data Flow Security + Security Updates + Hardening + System Integrity Verification + Application Hardening + Vulnerability Scanning + Logging + Anti-Virus.
SWIFTCSCF-2 · Reduce Attack Surface and Vulnerabilities (Objective 2) →A process shall be employed to perform penetration testing on the product, based on the threat model and the attack surface, by people with penetration testing expertise, before release and after significant change.
iec-62443::SVV-4 · Penetration testing →Employ physical isolation techniques, logical isolation techniques, or both across organizational systems and system components, so that CUI is separated into security domains behind managed interfaces, the attack surface is reduced and adversary movement betw...
3.13.4e · Physical and Logical Isolation Techniques →Questions people ask about attack surface
What is Attack Surface?
Why is Attack Surface important for compliance?
Which compliance frameworks address Attack Surface?
Where can I learn more about Attack Surface?
See how Attack Surface applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.