Attack surface

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes a system's attack surface?

A The single strongest password on the system

B All the points where an attacker could try to get in or take data out

2. An open port on a server is part of its attack surface.

A True

B False

3. A school server runs a file-sharing service that nobody uses. What should the IT team do?

A Leave it running in case it's needed one day

B Turn it off to shrink the attack surface

4. Which action makes the attack surface smaller?

A Deleting old user accounts that are no longer needed

B Creating extra admin accounts for convenience

5. Adding more services and open ports to a system makes its attack surface...

A Larger

B Smaller

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1nmap 192.168.1.10		Auserdel olduser
2net user		BLists the user accounts on a computer, and each account is another possible way in
3Closing an unused port with a firewall rule reduces the attack surface		Cufw deny 23
4Removing an account nobody uses reduces the attack surface		DScans a device to list its open ports and running services, which are part of its attack surface
5ufw allow 23 ufw allow 3389 ufw allow 21		EUnused accounts are extra ways in. They should be disabled or deleted so the attack surface is smaller.
6Keep the guest account and a spare admin account switched on 'just in case'		FOpening ports that nobody needs makes the attack surface bigger, not smaller. Only allow the ports that are really needed and deny the rest.

Definitions

attack surface

Fill in the Blanks

Complete each line of code by filling in the missing parts.

surface = openPorts _ accounts

FOR EACH service IN services IF service.needed = _____ THEN disable(service)

FOR EACH account IN accounts IF account.active = FALSE THEN ______(account)

// Telnet is not needed _________(23) OUTPUT "Port 23 closed"

before = 12 after = 9 IF after _ before THEN OUTPUT "Safer"

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A open_ports ← [22, 80, 443]

B FOR EACH port IN open_ports

C IF port is needed THEN

D close(port)

Question 2

A ports ← list_closed_ports()

B count ← LENGTH(ports)

C OUTPUT "Open ports: " + count

Question 3

A accounts ← get_all_accounts()

B FOR EACH acct IN accounts

C IF acct.active THEN

D disable(acct)

Question 4

A ports ← [21, 22, 80, 443]

B needed ← [22, 443]

C extra ← ports MINUS needed

D close_all(needed)

Question 5

A user ← create_account("sam")

B user.role ← "student"

C user.rights ← "full admin"

D save(user)

Answer Key

Attack surface

Section A: Quick Questions

B — All the points where an attacker could try to get in or take data out

A — True

B — Turn it off to shrink the attack surface

A — Deleting old user accounts that are no longer needed

A — Larger

Section B: Match the Pairs

nmap 192.168.1.10 → Scans a device to list its open ports and running services, which are part of its attack surface

net user → Lists the user accounts on a computer, and each account is another possible way in

Closing an unused port with a firewall rule reduces the attack surface → ufw deny 23

Removing an account nobody uses reduces the attack surface → userdel olduser

ufw allow 23 ufw allow 3389 ufw allow 21 → Opening ports that nobody needs makes the attack surface bigger, not smaller. Only allow the ports that are really needed and deny the rest.

Keep the guest account and a spare admin account switched on 'just in case' → Unused accounts are extra ways in. They should be disabled or deleted so the attack surface is smaller.

Section C: Definitions

attack surface — All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller attack surface means fewer ways in.

Section D: Fill in the Blanks

surface = openPorts + accounts

FOR EACH service IN services
  IF service.needed = FALSE THEN
    disable(service)

FOR EACH account IN accounts
  IF account.active = FALSE THEN
    delete(account)

// Telnet is not needed
closePort(23)
OUTPUT "Port 23 closed"

before = 12
after = 9
IF after < before THEN OUTPUT "Safer"

Section E: Spot the Error

C — This condition closes the ports that are needed and leaves the unneeded ones open. To shrink the attack surface it should read IF port is not needed THEN.

A — Closed ports are not a way in. The attack surface counts open ports, so the line should call list_open_ports().

C — This would disable accounts that are still being used. The program should disable unused accounts, so the test should be acct.inactive.

D — This closes the ports the system needs and leaves the extra ones open. It should be close_all(extra) to reduce the attack surface.

C — Giving a new account full admin rights widens the attack surface, because a stolen account could do anything. It should give the minimum rights, such as "read only".