What is Attack surface?

Understanding Attack surface

Different security testing methods find different vulnerability types. The attack surface represents the sum of all points where an unauthorized user might extract data or gain access to a system, including network interfaces, APIs, user interfaces, protocols, services, and even physical access points. A larger attack surface typically means increased vulnerability exposure. Security frameworks like NIST CSF and ISO 27001 emphasize attack surface reduction as a key security strategy. Organizations implement attack surface management through regular assessments, network segmentation, service minimization, and continuous monitoring. For example, a cloud service provider might reduce their attack surface by disabling unnecessary services, implementing strict network controls, and restricting administrative access to critical infrastructure. Related terms: Attack vector, Vulnerability management, Threat modeling, Defense in depth, Security posture.