Attack Surface Reduction
Definition
The systematic elimination of pathways an attacker could use to enter or move within a system. In incident response this includes closing ports, disabling protocols, removing unused accounts, and patching known vulnerabilities.
- Goal
- Eliminate attacker entry and lateral movement paths
- Common actions
- Closing ports, disabling protocols
- Also includes
- Removing unused accounts, patching vulnerabilities
- Response phase
- Used during incident containment and hardening
Common questions
How does attack surface reduction differ from patching alone?+
Patching addresses known software flaws, but attack surface reduction is broader: it also removes unnecessary services, protocols, and accounts that were never vulnerable in a CVE sense but still gave an attacker a usable path in or through the environment.
Why is attack surface reduction performed during containment rather than only after full remediation?+
Shrinking available pathways during an active incident limits how far an attacker who still has access can move, buying the response team time to investigate and eradicate without waiting for a complete, verified fix to every issue first.
Related terms
- Access Revocation
- The removal of permissions, accounts, or trust relationships that the attacker exploited or could exploit. Distinct from credential rotation in that it...
- Compensating Control
- A security measure that reduces risk when the ideal control cannot be applied immediately. For example, routing traffic through a monitored proxy...
- Credential Rotation
- The process of invalidating and replacing passwords, API keys, certificates, and other authentication tokens that may have been exposed during an incident....
- Long-Term Containment
- The incident response phase in which emergency stabilisation measures are replaced with durable controls, such as patches, credential rotation, and firewall changes,...
- System Hardening
- Configuration changes that reduce a system's attack surface by disabling unnecessary services, applying least-privilege access, enabling audit logging, and removing or restricting...