# What is an Attack Surface?

> An attack surface is the collection of points where an attacker could attempt to enter a system, influence its behavior, gain access, or remove data.

- Canonical URL: https://yellowcube.eu/glossary/attack-surface/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It includes technical interfaces and reachable services, but also identities, trust relationships, exposed management functions, cloud configurations, supplier connections, and workflows that an attacker could abuse.

Attack surfaces change continuously as organizations deploy services, create accounts, connect suppliers, move workloads, and leave old assets behind. Managing the surface therefore requires discovery, ownership, context, and controlled change — not only a periodic port scan.

Practical management starts with discovery: internal inventory for owned assets, and external scanning for what an outsider can find — including forgotten sites, shadow IT, and supplier-attributable infrastructure. Each surface element then needs an owner, a business purpose, and a risk decision: remove it, protect it, or accept the exposure.

### Key points

- **External surface:** Internet-facing domains, addresses, services, applications, cloud resources, and exposed credentials or data.
- **Internal surface:** Reachable systems, privileges, administrative paths, shared services, and lateral movement opportunities.
- **Reduction methods:** Remove unused assets, narrow access, harden interfaces, reduce privilege, segment dependencies, and remediate exploitable conditions.
- **Important limitation:** The smallest possible surface is not always the correct design; organizations still need usable services and must manage the risk of necessary exposure.

### Related terms

[Attack surface management (ASM)](<https://yellowcube.eu/glossary/attack-surface-management/>) · [Vulnerability management](<https://yellowcube.eu/glossary/vulnerability-management/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Least privilege](<https://yellowcube.eu/glossary/least-privilege/>)

### Sources

[NIST glossary: Attack Surface](https://csrc.nist.gov/glossary/term/attack_surface) · [CISA: Internet Exposure Reduction Guidance](https://www.cisa.gov/resources-tools/resources/exposure-reduction)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.