CompTIA Security+ Preparation · lesson 13 of 45 · 25 min
Attack Surface
The attack surface is the total set of points where an attacker could try to enter or extract data from an environment. Reducing the attack surface is a core security principle.
Network attack surface — open ports, exposed services, internet-facing systems, unpatched software, misconfigured firewalls.
Application attack surface — web forms, APIs, authentication endpoints, file upload functions, third-party libraries.
Human attack surface — employees susceptible to social engineering, phishing, insider threats.
Supply chain attack surface — third-party software, hardware, and services. SolarWinds attack (2020) compromised a software update mechanism to distribute malware to thousands of organizations.
Attack vector — the specific path or method an attacker uses to exploit a vulnerability. Examples: phishing email, unpatched web application, stolen credentials, physical access.
Indicators of Compromise (IoC) and Indicators of Attack (IoA)
IoC (Indicator of Compromise) — evidence that a system has already been compromised. Reactive — detected after the fact. Examples: known malware hash, C2 IP address in network logs, unusual outbound traffic, new admin accounts, modified system files.
IoA (Indicator of Attack) — evidence that an attack is in progress or being attempted. Proactive — detected in real time. Examples: multiple failed login attempts, port scanning, privilege escalation attempts, lateral movement.
Common IoCs: unusual processes, unexpected network connections, modified registry keys, disabled security tools, large data transfers to unknown IPs, files in unusual locations.
STIX/TAXII — standards for sharing threat intelligence. STIX (Structured Threat Information eXpression) defines the format; TAXII (Trusted Automated eXchange of Intelligence Information) defines the transport protocol.
IoC vs IoA
IoC = “We were compromised” (past tense — forensic evidence). IoA = “An attack is happening now” (present tense — behavioral detection). Modern security focuses on IoAs for earlier detection.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Attack Surface & IoCs
The attack surface includes:
- Only network-facing systems
- All points where an attacker could enter or extract data
- Only web applications
- Only physical entry points
- Answer: All points where an attacker could enter or extract data
The attack surface encompasses network, application, human, and supply chain vectors — all potential entry points. An IoC is:
- Evidence an attack is in progress
- Evidence a system has already been compromised
- A security policy
- A vulnerability scan result
- Answer: Evidence a system has already been compromised
IoCs are forensic evidence of past compromise — malware hashes, C2 IPs, modified files. Reactive detection. The SolarWinds attack is an example of:
- A phishing attack
- A supply chain attack
- A DDoS attack
- A SQL injection attack
- Answer: A supply chain attack
SolarWinds: attackers compromised the software build process to distribute malware through legitimate software updates to thousands of organizations. Multiple failed login attempts followed by a successful login is an example of:
- An IoC
- An IoA
- A false positive
- Normal behavior
- Answer: An IoA
Multiple failed logins followed by success indicates a brute force attack in progress — an Indicator of Attack (IoA). STIX and TAXII are used for:
- Encrypting network traffic
- Sharing threat intelligence in a standardized format
- Scanning for vulnerabilities
- Managing user accounts
- Answer: Sharing threat intelligence in a standardized format
STIX defines the format for threat intelligence; TAXII defines the transport protocol for sharing it between organizations.
Which is an example of an IoC?
- Port scan detected
- Known malware hash found on a system
- Multiple failed login attempts
- Privilege escalation attempt
Answer: Known malware hash found on a system
A known malware hash is forensic evidence of compromise — the malware is already present. This is an IoC.
Reducing the attack surface means:
- Adding more security tools
- Eliminating unnecessary services, ports, and access points
- Increasing monitoring
- Adding more users
- Answer: Eliminating unnecessary services, ports, and access points
Attack surface reduction: disable unused services, close unnecessary ports, remove unneeded software, apply least privilege. The human attack surface is exploited through:
- SQL injection
- Buffer overflow
- Social engineering and phishing
- Port scanning
- Answer: Social engineering and phishing
The human attack surface targets people — phishing, vishing, pretexting, and other social engineering techniques.
IoAs enable earlier detection of attacks than IoCs.
- True
- False
Answer: True
IoAs detect attacks in progress — earlier than IoCs which are detected after compromise. Behavioral detection is more proactive.
An attack vector is:
- The total attack surface
- The specific path or method used to exploit a vulnerability
- A type of malware
- A security control
- Answer: The specific path or method used to exploit a vulnerability
Attack vectors are specific methods: phishing email, unpatched vulnerability, stolen credentials, physical access.
Previous lesson: Vulnerability scanning and assessment concepts
Back to CompTIA Security+ Preparation
Next lesson: Indicators of compromise (IoC) and indicators of attack (IoA)