What is the attack surface?  

The attack surface is the sum of all the ways an unauthorised user can attempt to enter a system or network to steal data, disrupt operations, or cause harm.  Your cybersecurity attack surface isn't just a firewall or a single server, it’s all possible entry points.  

Key areas of the attack surface  

Security experts often split the attack surface into two distinct categories: physical and digital: 

Physical attack surface  

The physical attack surface refers to physical access, often neglected in small and medium-sized businesses. These include: 

• Premises and facilities: Weaknesses like unlocked doors, broken windows, or inadequate keycard entry. 

• Hardware and devices: Risks include device theft, weak BIOS/UEFI passwords, USB port access, and hardware tampering. 

• Human error and insider threats: Mistakes and malicious actions by employees or insiders. 

Digital attack surface  

The digital attack surface includes unauthorised access to systems and data through digital means. Common vulnerabilities include:   

• Weak passwords and identity management: Bad passwords, shared accounts, and lack of multi-factor authentication (MFA). 

• Software vulnerabilities: Misconfigured API allow hackers to inject malicious code.   

• Outdated IT and applications: Old software and hardware can unpatched vulnerabilities. 

Best practices for protecting and reducing your attack surface  

Now that you understand the basics, let's explore some practical steps to reduce your attack surface and avoid costly breaches.  

Eliminating entry points  

With a bit of security hygiene, you can easily eliminate entry points: 

• Deactivate redundant user accounts and update access privileges.  

• Uninstall inactive applications and perform regular software updates.   

• Close unused network ports and disable unnecessary services.   

Implement zero trust  

The principle of zero trust is simple: "Never trust, always verify”. Core principles include:   

• Least privilege access: Grant the minimum level of access required.   

• Verification should be continuous: Verify user identity throughout the session.   

• Microsegmentation: Divide security parameters into small segments to prevent lateral move by attackers.   

• Multi-factor authentication (MFA): Use multiple authentication factors.   

Vulnerability scanning  

Regular vulnerability scanning is essential.  Use automated tools like Microsoft Defender to scan systems, networks, and applications for known vulnerabilities.  

By understanding your attack surface, both physical and digital, you can significantly bolster your defences against cyber threats.