Minimize Attack Surface

What the Attack Surface Is

Networks can be breached, software can be compromised, and data can be stolen — unless it doesn't exist. So one of the things that we need to think about is, how do we minimize the attack surface?

Think of attack surface like a castle. If we wanted to gain access into this castle, how would we do it? If we wanted to compromise the castle, how would we do it? We would start looking at what the entry points are. What are the ways that we could get into it? That's the attack surface. And it's the same thing when it comes to networks. The attack surface is the total of all possible entry points into a system.

If I was looking at this network, I'd start analyzing: well, how could I get into this network? Maybe I could access it through the firewall. Or perhaps we have a wireless system and I can access it through that wireless system. Maybe there's software installed on a computer and I can access it through that software that's installed. Or perhaps I have a user on here that I know I could do some social engineering on to gain access to this network. So I am analyzing the attack surface, the sum of all surfaces that we can use to get into this network.

Trust Boundaries

It really has to do with trust boundaries and where those trust boundaries are. A trust boundary is a point where the level of trust or security changes within a system or network. A great example of these trust boundaries would be a firewall. This firewall right here has an insecure network on one side — the internet, or the rest of the networks that we consider not very secure; it's public information out there. And then we have the other side of the firewall, the inside of the network, which is a trust boundary. Right here, we've got a trust boundary where things are trusted more on one side than the other side.

So, as an adversary, what would I be looking for? Well, I'd be looking for those entry points. Maybe it's physical, where I can physically get onto the network. Or maybe there's a digital way of getting onto the network where I don't need to physically be there. Maybe I can get into that network via tricking some sort of human, some sort of social engineering. Or there are outside entities that I might be able to leverage to get into this network.

Physical Entry Points

From a physical perspective, that means I can actually gain access to the network itself. For instance, I've got a physical switch here. There are ports all over the building. If I could sneak into that building and connect my piece of equipment on here, I now have access to that whole building and can control things. I also may be able to trick a user into plugging in a USB device that has certain software that compromises this machine. Now I could have access to this machine, which gives me access to the rest of the network. Or perhaps I have some sort of new equipment that I could sell them and get installed onto their network, and now I have access to their network.

Digital Entry Points

There are also ways that I can get in from a digital perspective, where I can gain access into this network without physical equipment. Maybe this organization has some sort of insecure network, maybe there are some sort of open ports on a system that allow me to get into this network and access things because there are open ports on this firewall. Or perhaps there is some sort of wireless network that is not secured properly, or Bluetooth — there are systems within here that probably have some sort of Bluetooth that are operating that maybe I can leverage. Or the wired network itself, by plugging into this wired network: maybe their ports are just wide open and I'm able to quickly plug into a piece of equipment and access the rest of the network.

Maybe I do it through some sort of software. Software, when it's installed on a machine, at times goes and reaches out to the outside world. Well, if it's reaching out to the outside world, that means traffic is probably going to be coming back to it as well. Now I've got this two-way communication that's going back and forth. They can access this network through software.

There's also data files. Data files I think of from two different perspectives. There could be something like a Word document or an Excel document, or something that has a macro in it that I've incorporated some malicious software into. So there's some sort of malicious software that gets executed when you open up these data files. But just having the data files on our network as well gives us something that we could attack, something that we can grab, something that we could compromise. So keeping this extra data and files around creates something that can be compromised.

People

Now, a good organization that's very security conscious will make sure that they have updated firewalls that are doing their job, systems that are patched on a regular basis, and making sure they have secure networks involved. But still, a common weak point is the people on the network, who can be tricked into installing software, who can be tricked into doing something that they shouldn't do.

And how would they do that? Well, they could be tricked in person. For instance, there's tailgating, where somebody follows somebody into a business, into a building. Or it could be done through a video or a voice call or some sort of message base. There are common ways to trick humans into getting an adversary access into the rest of the network through that human.

Outside Entities

An organization usually isn't just working by themselves. They have to work with other entities out there as well. Maybe it's their customer base that they have to give access into their systems. Maybe there's some sort of partners that are out there. Maybe there's a supply chain, like a managed service provider, or perhaps some sort of vendor for some sort of equipment or for some sort of services.

So let's say we go out there and we purchase some laptops, and we purchase laptops from a vendor that isn't well known. Well, what they've done maybe is they installed some sort of virus on the system, and then now you come and plug it in and configure it on your system, and now the rest of your network is compromised, because you bought it from a vendor that doesn't have the proper security practices in place and is unknown. So there are outside entities that we need to watch out for as well.

Minimizing the Attack Surface

The whole goal of this is to minimize the attack surface, that we analyze this attack surface and make sure that the entry points are minimized. So what does this look like in practice? Well, maybe it is that we need to minimize our physical presence. Maybe we don't have as many switches as we normally would have. Maybe we need to minimize our digital network and make sure that our attack surface is fairly small. Maybe we need to minimize, once again, the software that we have, the network that we have, or maybe the data — the more data we have, the more data that could be compromised. Maybe we need to minimize human access, that is, that we make sure that the humans that have access into our network have the least amount of privileges. Then there's also the outside entities. Maybe we limit how many vendors we're actually working with. Maybe we vet them better to make sure that we are choosing the right vendors.

An Ongoing Process

And this is not something that we just do once. We do go through a process where we determine what our attack surface is. Once we understand what our attack surface is, how do we reduce that attack surface and then monitor that attack surface? But this is an ongoing process. We do need to have periodic reviews. So as we're monitoring this, we're going to go in and do some sort of audit to determine, once again, do we have an accurate viewpoint of what that attack surface is, or has something changed?