5.1 What an Attack Surface Is
What Counts as Surface
An attack surface is the union of every point at which an unauthorised actor can attempt to interact with your systems: network listeners, application interfaces, user accounts, physical entry points, and people. A single web application is not one entry vector but a sum: the public HTTP listener, the API routes it exposes, the admin panel behind it, the vendor support portal that can reach it, and the helpdesk account that can reset its passwords. A vector becomes a real intrusion path only when three things line up: an exposed interface, a reachable path to it, and a weakness to exploit. Measuring surface counts interfaces; measuring risk asks which interfaces currently have all three at once.
The Sum Is Additive
Surface is additive: the forgotten VPN appliance, the marketing staging site, the SaaS tool a team adopted without telling IT -- each adds a term, and adversaries optimise for the smallest one. That is why adversary discovery is mostly inventory rather than intrusion: internet-wide scanners index open ports, banners, and certificates continuously, so the public internet already lists your exposure before an attacker touches it. Defenders rebuild the same picture passively: certificate-transparency logs and passive DNS reveal forgotten subdomains; port scans and banner grabs fingerprint exposed services; account enumeration shows which identities are worth testing. External attack surface management is simply performing that inventory faster than the adversary does.
People and Devices Are Surface Too
Two terms are chronically undercounted. Physical vectors -- removable USB media, unattended kiosks, badge-tailgated doors -- bypass network controls entirely because they never touch the perimeter. And people: the helpdesk, the finance team, every employee with a phone number is an interface that accepts natural-language input and has no rate limiting. Every person is also a device holder, carrying laptops, phones, and OAuth grants to third-party apps that extend the surface into cloud tenants nobody scans. Shrinking the surface is subtraction: close unused listeners, decommission shadow services, apply least privilege so each remaining vector grants little, and wherever a vector must stay open, add EDR telemetry so exposure at least comes with observation.
Architecture Diagram
Key Takeaways
- Attack surface is the union of all reachable interfaces -- listeners, accounts, devices, physical points, and people.
- A vector becomes an intrusion path only with exposure, reachability, and an exploitable weakness together.
- Surface is additive; adversaries mass-scan the public estate and pick the cheapest term.
- Discover your own surface passively first: certificate logs, passive DNS, banner grabs, and account enumeration.
- Shrink by subtraction: close, decommission, least privilege -- and cover what stays open with EDR telemetry.