Attack surface
≈ 2 min read
Names in other languages
No names in other languages are held for this entry yet.
Article bodies are English and are not machine-translated. A name in another language is not a translation of the article.
The attack surface of a software environment is the sum of the different points (for attack vectors) where an unauthorized user (the "attacker") can try to enter data to, extract data from, or control a device or critical software in an environment. Ted. G. Lewis compares cyber attack-surfaces with battlefield attack-surfaces. Keeping the attack surface as small as possible is a basic computing security measure.
The attack surface of a software environment is the sum of the different points (for attack vectors) where an unauthorized user (the "attacker") can try to enter data to, extract data from, or control a device or critical software in an environment. Ted. G. Lewis compares cyber attack-surfaces with battlefield attack-surfaces. Keeping the attack surface as small as possible is a basic computing security measure. == Surface reduction== One approach to improving information security is to reduce the attack surface of a system or software. The basic strategies of attack surface reduction include the following: reduce the amount of code running, reduce entry points available to untrusted users, and eliminate services requested by relatively few users. By having less code available to unauthorized actors, there tend to be fewer failures. By turning off unnecessary functionality, there are fewer security risks. Although attack surface reduction helps prevent security failures, it does not mitigate the amount of damage an attacker could inflict once a vulnerability is found. ==References==
Text derived from https://en.wikipedia.org/w/index.php?oldid=1370091879 under CC BY-SA 4.0; modifications have been made.