{"id":5848,"date":"2021-09-28T11:00:00","date_gmt":"2021-09-28T08:00:00","guid":{"rendered":"https:\/\/blog.eset.ee\/?p=5848"},"modified":"2026-06-14T10:27:15","modified_gmt":"2026-06-14T07:27:15","slug":"what-is-a-cyberattack-surface-and-how-can-you-reduce-it","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2021\/09\/28\/what-is-a-cyberattack-surface-and-how-can-you-reduce-it\/","title":{"rendered":"What is a cyberattack surface and how can you reduce it?"},"content":{"rendered":"

<\/p>\n

In almost all coverage of modern breaches you\u2019ll hear mention of the \u201ccyberattack surface\u201d or something similar. It\u2019s central to understanding how attacks work and where organizations are most exposed. During the pandemic the attack surface has grown arguably further and faster than at any point in the past. And this has created its own problems. Unfortunately, organizations are increasingly unable to define the true size and complexion of their attack surface today\u2014leaving their digital and physical assets exposed to threat actors.<\/p>\n

<\/p>\n

<\/p>\n

Fortunately, by executing a few best practices, these same defenders can also improve their visibility of the attack surface, and with it, gain enhanced understanding of what\u2019s necessary to minimize and manage it.<\/p>\n

<\/p>\n

<\/p>\n

What is the corporate attack surface?<\/strong><\/h2>\n

<\/p>\n

<\/p>\n

At a basic level, the attack surface can be defined as the physical and digital assets an organization holds that could be compromised to facilitate a cyber-attack. The end goal of the threat actors behind it could be anything from deploying ransomware and stealing data to conscripting machines into a botnet, downloading banking trojans or installing crypto-mining malware. The bottom line is: the bigger the attack surface, the larger the target the bad guys have to aim at.<\/p>\n

<\/p>\n

<\/p>\n

Let\u2019s take a look at the two main attack surface categories in more detail:<\/p>\n

<\/p>\n

<\/p>\n

The digital attack surface<\/strong><\/h3>\n

<\/p>\n

<\/p>\n

This describes all of an organization\u2019s network-connected hardware, software and related components. These include:<\/p>\n

<\/p>\n

<\/p>\n

Applications: <\/strong>Vulnerabilities in apps are commonplace, and can offer attackers a useful entry point into critical IT systems and data.<\/p>\n

<\/p>\n

<\/p>\n

Code<\/strong>: A major risk now that much of it is being compiled from third-party components, which may contain malware or vulnerabilities.<\/p>\n

<\/p>\n

<\/p>\n

Ports:<\/strong> Attackers are increasingly scanning for open ports and whether any services are listening on a specific port (e.g., TCP port 3389 for RDP). If those services are misconfigured or contain bugs, these can be exploited.<\/p>\n

<\/p>\n

<\/p>\n

Servers: <\/strong>These could be attacked via vulnerability exploits or flooded with traffic in DDoS attacks.<\/p>\n

<\/p>\n

<\/p>\n

Websites: <\/strong>Another part of the digital attack surface with multiple vectors for attack, including code flaws and misconfiguration. Successful compromise can lead to web defacement, or implanting malicious code for drive-by and other attacks (e.g., formjacking<\/a>).<\/p>\n

<\/p>\n

<\/p>\n

Certificates:<\/strong> Organizations frequently let these expire<\/a>, allowing attackers to take advantage.<\/p>\n

<\/p>\n

<\/p>\n

This is far from an exhaustive list. To highlight the sheer scale of the digital attack surface, consider this 2020 research into firms on the FTSE 30 list. It found<\/a>:<\/p>\n

<\/p>\n

<\/p>\n