PDF p.33
In progress
Attack Surface and Threat Vectors
Summary
PDF p.33The attack surface encompasses all points where a threat actor could exploit vulnerabilities. Minimizing the attack surface involves restricting access to known endpoints and monitoring for intrusions. Threat vectors are the paths used by threat actors to execute attacks.
In plain words
Supplementary — not from your PDFThe attack surface is every point where an attacker could interact with your systems. Threat vectors are the paths they use through it. The smaller the surface, the fewer the ways in.
Detailed explanation
PDF p.33-
Attack Surface
- Definition: All points where a threat actor can interact with a network port, app, computer, or user.
- Minimization: Restrict access to known endpoints, protocols/ports, and services/methods.
- Assessment: Evaluate for vulnerabilities and monitor for intrusions.
- Scope: Can be assessed for an entire organization or specific components (e.g., servers, web applications, employee accounts).
-
Threat Vectors
- Definition: Paths used by threat actors to execute attacks (data exfiltration, service disruption, disinformation).
- Sophistication: Use multiple vectors and plan multistage campaigns.
- Novel Vectors: Highly capable actors develop new vectors, potentially knowing the attack surface better than the organization.
-
Terminology
- Threat Vector vs. Attack Vector: Often used interchangeably; some sources distinguish threat vector (potential attack surface analysis) from attack vector (executed exploit analysis).
Important terms
taken from the text above- Attack Surface
- All points where a threat actor can interact with a network port, app, computer, or user.
- Minimization
- Restrict access to known endpoints, protocols/ports, and services/methods.
- Assessment
- Evaluate for vulnerabilities and monitor for intrusions.
- Threat Vectors
- Paths used by threat actors to execute attacks (data exfiltration, service disruption, disinformation).
- Sophistication
- Use multiple vectors and plan multistage campaigns.
- Novel Vectors
- Highly capable actors develop new vectors, potentially knowing the attack surface better than the organization.
- Threat Vector vs. Attack Vector
- Often used interchangeably; some sources distinguish threat vector (potential attack surface analysis) from attack vector (executed exploit analysis).
Examples & real-world scenarios
Supplementary — not from your PDF- Attack surface: open ports, web apps, employee email accounts, USB ports.
- Reducing it: closing unused ports and disabling old services.
- Vector: a phishing email is the path; the mailbox is part of the surface.
Scenario
A company finds 40 internet-facing services it didn't know about. Before buying new tools, the security team switches off the unneeded ones. That shrinks the attack surface cheaply.
Common mistakes
Supplementary — not from your PDF- Treating attack surface and threat vector as the same thing: the surface is the 'where', the vector is the 'how'.
- Forgetting that people (email, phone) are part of the attack surface too.
Practical skills
Supplementary — not from your PDF- List an organization's attack surface and suggest ways to reduce it.
What I should remember
Key Points PDF p.33-
Attack Surface
- Definition: Points of potential vulnerability exploitation.
- Minimization: Restrict access, assess vulnerabilities, monitor intrusions.
- Scope: Organization-wide or specific components.
-
Threat Vectors
- Definition: Paths for executing attacks.
- Sophistication: Multiple vectors, multistage campaigns.
- Novel Vectors: Developed by highly capable actors.
-
Terminology
- Threat Vector: Potential attack surface analysis.
- Attack Vector: Executed exploit analysis.