- Attack surface reduction (ASR) is a security measure designed to reduce the number and variety of potential attack surfaces available to an attacker.
- ASR is distinct from vulnerability management, which concentrates on reducing the likelihood that a vulnerability can be exploited by an attacker.
- By removing unnecessary features and functionality from products, services, and systems that are deployed in live environments, an organization can greatly reduce its overall exposure to vulnerabilities.
- ASR can be achieved through a number of mechanisms, such as Methodology for attack surface reduction.
- The approach for attack surface reduction is similar to the methodology for software testing.
- Attack surface metrics, which help to calculate risk and return of investment (ROI).
- There are various tools available in the market that can perform some or all of these tasks related to attack surface analysis and reduction. Some examples are Microsoft Baseline Security Analyzer(MBSA), WebInspect, WebEssentials, Windows Defender Exploit Guard, Nessus, and several others.
Key Points:
- Attack surfaces can be divided into a number of categories which can be used to gain a better understanding of what is being searched for.
- Port scans and OS-specific exploits have been used for decades, but more recently it has become more common for ethical hackers to use software designed specifically to examine web server configuration, application security, and software vulnerabilities themselves – using tools such as WebScarab and various web application scanners.
- All of these methods are targeted at the operating system itself rather than a specific piece of application software.
- In order to successfully find vulnerabilities in the software that has been installed on a networked device, it is important for an ethical hacker to have a good working knowledge of what is installed.
- This requires a detailed understanding of the organization’s IT architecture and its associated risks, as well as knowing how to use the technologies required to perform assessments.
- Vulnerabilities are also often identified during penetration testing activities, where security testing is performed using an external remote connection; this activity can help identify potential command injection bugs and other flaws in software or hardware which allow unauthorized access.
- Software designed specifically for attack surface analysis runs on Linux systems and typically uses an agent or client-server model.
In ethical hacking, attack surfaces are searched for using software that is specifically designed for this purpose; typically these applications will examine various data like file permissions, network ports, running processes, and more so that a
