← Years 9–10 Digital Systems

Attack surface

All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller attack surface means fewer ways in.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 38, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 14, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 11

Understanding Attack surface in Years 9–10 Digital Systems

What it does: Blocking port 23 (Telnet) removes one entry point, so the attack surface gets smaller. Deleting an unused account takes away a login that an attacker could target, so there are fewer ways in. More services and open ports mean more points an attacker could try, so the attack surface grows. Closing unneeded ports takes away entry points. Opening them all does the opposite.

Common mistakes: This condition closes the ports that are needed and leaves the unneeded ones open. To shrink the attack surface it should read IF port is not needed THEN. Closed ports are not a way in. The attack surface counts open ports, so the line should call list_open_ports().

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Attack surface to a class →

This module's key terms are also in a printable crossword (Modules 25–40) and word search (Modules 13–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which best describes a system's attack surface?
All the points where an attacker could try to get in or take data outThe single strongest password on the system
Matches
ufw allow 23 ufw allow 3389 ufw allow 21
↓
Opening ports that nobody needs makes the attack surface bigger, not smaller. Only allow the ports that are really needed and deny the rest.
Applying
Meanings
Term
attack surface
Meaning
All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller attack surface means fewer ways in.
Practice
SET open_ports TO 22, 80, 443, 21
Testing
Gaps
surface = openPorts accounts
Check Answer
Spots
2FOR EACH port IN open_ports
3 IF port is needed THEN

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Arctic Fox' badge — Tundra Tracker, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes a system's attack surface?
A. The single strongest password on the system
B. All the points where an attacker could try to get in or take data out ✓
The attack surface is the total set of entry and exit points an attacker could target, not just one weak spot.
2. An open port on a server is part of its attack surface.
A. True ✓
B. False
Each open port with a service listening on it is a possible way in, so it adds to the attack surface.
3. A school server runs a file-sharing service that nobody uses. What should the IT team do?
A. Leave it running in case it's needed one day
B. Turn it off to shrink the attack surface ✓
Unused services still have vulnerabilities an attacker could exploit. Turning them off removes a way in.
4. Which action makes the attack surface smaller?
A. Deleting old user accounts that are no longer needed ✓
B. Creating extra admin accounts for convenience
Every user account is a possible target. Removing unused accounts means fewer ways in for an attacker.
5. Adding more services and open ports to a system makes its attack surface...
A. Larger ✓
B. Smaller
More services and open ports mean more points an attacker could try, so the attack surface grows.

Match the Pairs

nmap 192.168.1.10 → Scans a device to list its open ports and running services, which are part of its attack surface
net user → Lists the user accounts on a computer, and each account is another possible way in
Closing an unused port with a firewall rule reduces the attack surface → ufw deny 23
Removing an account nobody uses reduces the attack surface → userdel olduser
ufw allow 23 ufw allow 3389 ufw allow 21 → Opening ports that nobody needs makes the attack surface bigger, not smaller. Only allow the ports that are really needed and deny the rest.
Keep the guest account and a spare admin account switched on 'just in case' → Unused accounts are extra ways in. They should be disabled or deleted so the attack surface is smaller.

Key Term

attack surface
All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller attack surface means fewer ways in.

Fill in the Blanks

1. surface = openPorts + accounts
Hint: Type the operator that adds the entry points together to find the total attack surface
2. FOR EACH service IN services IF service.needed = FALSE THEN disable(service)
Hint: Type the Boolean value that means the service is not needed, so it can be switched off
3. FOR EACH account IN accounts IF account.active = FALSE THEN delete(account)
Hint: Type the function name that removes an unused user account to shrink the attack surface
4. // Telnet is not needed closePort(23) OUTPUT "Port 23 closed"
Hint: Type the function name that shuts an open port so attackers cannot connect to it
5. before = 12 after = 9 IF after < before THEN OUTPUT "Safer"
Hint: Type the comparison operator that shows the attack surface is now smaller than before

Spot the Error

Question 1
A open_ports ← [22, 80, 443]
B FOR EACH port IN open_ports
C IF port is needed THEN
D close(port)
Line C — This condition closes the ports that are needed and leaves the unneeded ones open. To shrink the attack surface it should read IF port is not needed THEN.
Question 2
A ports ← list_closed_ports()
B count ← LENGTH(ports)
C OUTPUT "Open ports: " + count
Line A — Closed ports are not a way in. The attack surface counts open ports, so the line should call list_open_ports().
Question 3
A accounts ← get_all_accounts()
B FOR EACH acct IN accounts
C IF acct.active THEN
D disable(acct)
Line C — This would disable accounts that are still being used. The program should disable unused accounts, so the test should be acct.inactive.
Question 4
A ports ← [21, 22, 80, 443]
B needed ← [22, 443]
C extra ← ports MINUS needed
D close_all(needed)
Line D — This closes the ports the system needs and leaves the extra ones open. It should be close_all(extra) to reduce the attack surface.
Question 5
A user ← create_account("sam")
B user.role ← "student"
C user.rights ← "full admin"
D save(user)
Line C — Giving a new account full admin rights widens the attack surface, because a stolen account could do anything. It should give the minimum rights, such as "read only".

Student with a class code? Join your class →