Attack Surface Determination

Question 1

Technical Attack Surface

Answer 1

All potential entry points in an organization’s technology infrastructure

Question 2

Architecture Reviews

Answer 2

Evaluate system design to identify weaknesses or misconfigurations

Question 3

Software Composition Analysis (SCA)

Answer 3

Identifies and manages third-party components for security and compliance

Question 4

Fuzzing

Answer 4

Injecting randommized data into executing code to find weaknesses in input handling

Question 5

Operational Attack Surface

Answer 5

Encompasses the vulnerabilities that arise from day-to-day operations and human factors within an organization

Question 6

User Factors

Answer 6

Potential risks introduced by users such as weak passwords, phishing susceptibility, or misuse of privileges

Question 7

Enumeration and Discovery of Unsanctioned Accounts

Answer 7

Focuses on identifying unauthorized or orphaned user accounts that could be used by malicious actors to gain access to sensitive systems

Question 8

Organizational Attack Surface

Answer 8

Encompasses vulnerabilities in external relationships and public-facing digital footprint

Question 9

Enumeration and Discovery of Third-Party Connections

Answer 9

Involves identifying and assessing all external entities that have access to the organization’s systems or data

Question 10

Enumeration and Discovery of Public Digital Presence

Answer 10

Map online assets, including websites, social media accounts, and publicly accessible systems, identifying potential exposure points for attackers