Cyberstudy
PDF p.121 In progress

Attack Surface

Open PDF at p.121 20 flashcards

Summary

PDF p.121

The network attack surface includes all points where a threat actor could gain access to hosts and services. Analyzing the attack surface using the layer model helps identify potential vulnerabilities at different network layers. Security controls must be implemented at each layer to prevent, detect, and correct attacks, following the principle of defense in depth.

In plain words

Supplementary — not from your PDF

The network attack surface is every point where someone could get access to hosts and services: physical ports and Wi-Fi (layers 1–2), network addressing (layer 3), and open ports and application services (layers 4–7). Defense in depth puts controls at every layer. Common architectural weaknesses include single points of failure, complex dependencies, shortcuts that favour availability, missing documentation, and relying only on the perimeter.

Detailed explanation

PDF p.121
  • Layer Model Analysis
    • Layer 1/2
      • Unauthorized Access: Connect to wall ports or wireless networks.
      • Communication: With hosts within the same broadcast domain.
    • Layer 3
      • Network Address: Obtain a valid network address, possibly by spoofing.
      • Communication: With hosts in other zones.
    • Layer 4/7
      • Connections: Establish connections to TCP or UDP ports.
      • Communication: With application layer protocols and services.
  • External/Public vs. Internal/Private Attack Surface
    • External/Public: Points of access from outside the network.
    • Internal/Private: Points of access within the network.
  • Security Controls
    • Defense in Depth: Multiple control categories and functions for layered protection.
    • Network Perimeter: Controls to prevent external attacks.
    • Segregated Zones: Mitigate risks from compromised or unauthorized internal hosts.
  • Common Weaknesses in Network Architecture
    • Single Points of Failure
      • Definition: Reliance on a single hardware server, appliance, or network channel.
    • Complex Dependencies
      • Definition: Services requiring many different systems to be available.
      • Impact: Failure of individual systems should not affect overall network performance.
    • Availability Over Confidentiality and Integrity
      • Definition: Taking shortcuts to get services running, compromising security.
      • Impact: Creates long-term risks.
    • Lack of Documentation and Change Control
      • Definition: Adding segments, appliances, and services without proper procedures.
      • Impact: Lack of visibility into network constitution.
    • Overdependence on Perimeter Security
      • Definition: Flat network architecture allowing any host to contact any other host.
      • Impact: Penetrating the network edge gives attackers freedom of movement.

Important terms

taken from the text above
Unauthorized Access
Connect to wall ports or wireless networks.
Network Address
Obtain a valid network address, possibly by spoofing.
Connections
Establish connections to TCP or UDP ports.
External/Public
Points of access from outside the network.
Internal/Private
Points of access within the network.
Defense in Depth
Multiple control categories and functions for layered protection.
Network Perimeter
Controls to prevent external attacks.
Segregated Zones
Mitigate risks from compromised or unauthorized internal hosts.
Single Points of Failure
Reliance on a single hardware server, appliance, or network channel.
Complex Dependencies
Services requiring many different systems to be available.
Availability Over Confidentiality and Integrity
Taking shortcuts to get services running, compromising security.
Lack of Documentation and Change Control
Adding segments, appliances, and services without proper procedures.
Overdependence on Perimeter Security
Flat network architecture allowing any host to contact any other host.

Examples & real-world scenarios

Supplementary — not from your PDF
  • An open wall port in a meeting room (layer 1/2 exposure).
  • An unneeded service listening on a server (layer 4/7 exposure).
  • A flat network where one compromised laptop can reach every server.

Scenario

An organization has a strong edge firewall but no internal segmentation. Once one phishing victim's PC is compromised, the attacker can move anywhere. That's overdependence on perimeter security.

Common mistakes

Supplementary — not from your PDF
  • Counting only Internet-facing systems. There's an internal attack surface too.
  • Treating defense in depth as more of the same control, when it means different controls at each layer.

Practical skills

Supplementary — not from your PDF
  • List the attack surface of a small network by OSI layer.
  • Spot common architectural weaknesses in a diagram.

What I should remember

Key Points PDF p.121
  • Layer Model Analysis
    • Layer 1/2: Unauthorized access to wall ports/wireless networks.
    • Layer 3: Obtain valid network address, communicate with other zones.
    • Layer 4/7: Establish connections to TCP/UDP ports, communicate with application protocols.
  • External/Public vs. Internal/Private Attack Surface
    • External/Public: Outside network access points.
    • Internal/Private: Inside network access points.
  • Security Controls
    • Defense in Depth: Layered protection.
    • Network Perimeter: Prevent external attacks.
    • Segregated Zones: Mitigate internal risks.
  • Common Weaknesses
    • Single Points of Failure: Reliance on single hardware/server.
    • Complex Dependencies: Multiple systems required.
    • Availability Over Security: Shortcuts compromising security.
    • Lack of Documentation: Poor change control.
    • Overdependence on Perimeter Security: Flat network architecture.