Thinking through a network boundary characterization, say firewall/IDS flux. How some activity may change profile of that surface.

  • 1
    I'm not sure what you're asking here. Can you provide an example of the "profile of that surface" and an example of an activity that may change it, and your definition of a characterization? – Xander May 9 at 13:49
  • Say Snort/Suricata rules; these rules identify specific patterns in PCAP that will "alert" when there is a match. This can occur randomly or in a specific alerting pattern based on packets received. So provided the alerting profile of the portfolio of rules enabled, trying to understand whether this can be indicative of a cyber surface... or are there better methods... – user207558 May 9 at 13:54
  • How would you define a "Cyber Surface"? This seems a lot like coorperate speak and not like a technical definition. – MechMK1 May 9 at 14:32

I believe the OP is referring to a concept I usually call "Attack Surface"

Attack surface is mental visualization tool used to picture the aggregation of all the various vectors an adversary might use or attempt to use to affect the confidentiality, availability or integrity of your data or systems.

To envision an attack surface one should visualize the system in question and the adversary. An example of why both should be pictured: Imagine a remote adversary attacking a windows machine. He may be able to steal information from a device's memory by physically removing the drive and mounting it on system under his control, but we can exclude this vector from the attack surface because it is impossible without physical access.

If you think through each vector and imagine each of them taking up a physical amount of space you can envision it being harder to defend the larger that surface is. For example image a soccer(football) goal that is twice as large as regulation size...it would be much easier to score against. In this analogy you could think of preventative security controls as defenders that stand at the goal line as during certain penalty kick situations. They are somewhat static but can significantly reduce the attack surface if positioned correctly. An example of a preventative control would be a firewall.

To imagine security monitoring controls imaging standing in a soccer(football) stadium and being unable to see the goal area because of a massive person standing in front of you. If you had a camera that could see some portion of the goal you could monitor if a ball passed through that portion (and only that portion)..this would be a monitoring control such as an IDS.

  • If I may add a specific image I find useful, the surface is a surface surrounding that which you wish to protect, where one assumes a hacker cannot control what happens inside the surface. Outside the surface, the attacker has much more control (often we assume unlimited control). If an attacker finds a vulnerability in the surface, they get inside, and all of our assumptions of security provided by that surface fall apart. And, as you said, the larger the surface area, the more potential vulnerabilities there are. – Cort Ammon - Reinstate Monica May 9 at 15:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.