Reduce Your Attack Vectors, Not Your Attack Surface

Why bigger is better when it comes to your attack surface

Although the term “attack surface” has been around for well over two decades, its importance has been under-emphasized, especially in the “cloud era.” We advise every chief information security officer and security team to take a thorough look at how they are defining and managing their attack surface as a foundational step in their security program. And, we challenge the common wisdom that your goal is to reduce your attack surface. Bigger is actually better. 

Of course, it’s all in how you look at it. And how you look at your attack surface is undeniably important to being able to effectively assess your organization’s IT risk. 

The term “attack surface” is sometimes defined as the collection of ways an organization can be breached. But that is really just the sum of your organization’s attack vectors.

Definition of an attack surface

A better definition of attack surface is: all of your attacker-exposed IT assets, whether secure or vulnerable, known and unknown, wherever they are: on-premises, in the cloud, in third-party or partner environments, or in the networks of your subsidiaries.

That’s a better definition of “attack surface” because organizations benefit from having an understanding and visibility into their entire IT ecosystem that includes all of their network interconnectivity.

Why is it important to have the broadest view of your attack surface – making it bigger, not smaller? Attackers are looking for the path of least resistance in your attack surface so that they can break into your high-value digital assets. To stay ahead, you have to think like an attacker too. That requires ongoing visibility of your entire attack surface by performing reconnaissance across your entire IT ecosystem, adopting an outside-in approach.

Organizations invest in basic risk assessment for only about 30% of their attack surface, and in-depth assessment for about 1%. Attackers target your entire attack surface, with a particular focus on the remaining 70% that you aren’t aware of and don’t assess.

With the full view of your attacker-exposed assets, you have a good foundation for evaluating your organizational risk and establishing an effective security program that allows you and your team to focus your resources on eliminating the highest priority risks for your business.

Requirements for an effective attack surface management

Effective attack surface management requires:

• Visibility of your entire attack surface, particularly the unknown, abandoned and unmanaged assets that attackers seek as easy points of entry
• Understanding the business context of each asset based on the business functions supported by the applications and data on the asset
• Knowing which group in your organization owns the asset, what IT environments it is part of, and whether it is part of a partner or third-party network
• Identification and prioritization of potential attack vectors in your attack surface so you know where your team should focus their efforts
• Continuous security monitoring to maintain the full and current view of your attack surface

You want to reduce the number of attack vectors in your attack surface, not your attack surface. Your attack surface will grow and shrink as the needs of your organization changes. Reducing the number of attack vectors, especially critical ones, is what you want to control.

Some sources reference the term “attack surface reduction,” and offer tips for reducing the size of an organization’s attack surface. What’s implied in that approach is that the attack surface is being defined as the sum of attack vectors as opposed to the more useful definition of attack surface as the collection of all the assets associated with an organization, whether currently deemed vulnerable or not.

As opposed to “reducing” your attack surface, you should seek to develop an attack surface map that expands your organization’s previous knowledge about the composition of the attack surface. This includes unknown assets, unknown infrastructure, cloud environments and applications and other shadow IT. Visibility of your entire attack surface is critical to your ability to identify and manage your shadow risk, the risk associated with your attacker-exposed assets.

It’s the high priority risks that you want to focus on reducing, not the size of your organization’s known attack surface.