Attack Surface
Summary
PDF p.121The network attack surface includes all points where a threat actor could gain access to hosts and services. Analyzing the attack surface using the layer model helps identify potential vulnerabilities at different network layers. Security controls must be implemented at each layer to prevent, detect, and correct attacks, following the principle of defense in depth.
In plain words
Supplementary — not from your PDFThe network attack surface is every point where someone could get access to hosts and services: physical ports and Wi-Fi (layers 1–2), network addressing (layer 3), and open ports and application services (layers 4–7). Defense in depth puts controls at every layer. Common architectural weaknesses include single points of failure, complex dependencies, shortcuts that favour availability, missing documentation, and relying only on the perimeter.
Detailed explanation
PDF p.121-
Layer Model Analysis
-
Layer 1/2
- Unauthorized Access: Connect to wall ports or wireless networks.
- Communication: With hosts within the same broadcast domain.
-
Layer 3
- Network Address: Obtain a valid network address, possibly by spoofing.
- Communication: With hosts in other zones.
-
Layer 4/7
- Connections: Establish connections to TCP or UDP ports.
- Communication: With application layer protocols and services.
-
Layer 1/2
-
External/Public vs. Internal/Private Attack Surface
- External/Public: Points of access from outside the network.
- Internal/Private: Points of access within the network.
-
Security Controls
- Defense in Depth: Multiple control categories and functions for layered protection.
- Network Perimeter: Controls to prevent external attacks.
- Segregated Zones: Mitigate risks from compromised or unauthorized internal hosts.
-
Common Weaknesses in Network Architecture
-
Single Points of Failure
- Definition: Reliance on a single hardware server, appliance, or network channel.
-
Complex Dependencies
- Definition: Services requiring many different systems to be available.
- Impact: Failure of individual systems should not affect overall network performance.
-
Availability Over Confidentiality and Integrity
- Definition: Taking shortcuts to get services running, compromising security.
- Impact: Creates long-term risks.
-
Lack of Documentation and Change Control
- Definition: Adding segments, appliances, and services without proper procedures.
- Impact: Lack of visibility into network constitution.
-
Overdependence on Perimeter Security
- Definition: Flat network architecture allowing any host to contact any other host.
- Impact: Penetrating the network edge gives attackers freedom of movement.
-
Single Points of Failure
Important terms
taken from the text above- Unauthorized Access
- Connect to wall ports or wireless networks.
- Network Address
- Obtain a valid network address, possibly by spoofing.
- Connections
- Establish connections to TCP or UDP ports.
- External/Public
- Points of access from outside the network.
- Internal/Private
- Points of access within the network.
- Defense in Depth
- Multiple control categories and functions for layered protection.
- Network Perimeter
- Controls to prevent external attacks.
- Segregated Zones
- Mitigate risks from compromised or unauthorized internal hosts.
- Single Points of Failure
- Reliance on a single hardware server, appliance, or network channel.
- Complex Dependencies
- Services requiring many different systems to be available.
- Availability Over Confidentiality and Integrity
- Taking shortcuts to get services running, compromising security.
- Lack of Documentation and Change Control
- Adding segments, appliances, and services without proper procedures.
- Overdependence on Perimeter Security
- Flat network architecture allowing any host to contact any other host.
Examples & real-world scenarios
Supplementary — not from your PDF- An open wall port in a meeting room (layer 1/2 exposure).
- An unneeded service listening on a server (layer 4/7 exposure).
- A flat network where one compromised laptop can reach every server.
Scenario
An organization has a strong edge firewall but no internal segmentation. Once one phishing victim's PC is compromised, the attacker can move anywhere. That's overdependence on perimeter security.
Common mistakes
Supplementary — not from your PDF- Counting only Internet-facing systems. There's an internal attack surface too.
- Treating defense in depth as more of the same control, when it means different controls at each layer.
Practical skills
Supplementary — not from your PDF- List the attack surface of a small network by OSI layer.
- Spot common architectural weaknesses in a diagram.
What I should remember
Key Points PDF p.121-
Layer Model Analysis
- Layer 1/2: Unauthorized access to wall ports/wireless networks.
- Layer 3: Obtain valid network address, communicate with other zones.
- Layer 4/7: Establish connections to TCP/UDP ports, communicate with application protocols.
-
External/Public vs. Internal/Private Attack Surface
- External/Public: Outside network access points.
- Internal/Private: Inside network access points.
-
Security Controls
- Defense in Depth: Layered protection.
- Network Perimeter: Prevent external attacks.
- Segregated Zones: Mitigate internal risks.
-
Common Weaknesses
- Single Points of Failure: Reliance on single hardware/server.
- Complex Dependencies: Multiple systems required.
- Availability Over Security: Shortcuts compromising security.
- Lack of Documentation: Poor change control.
- Overdependence on Perimeter Security: Flat network architecture.