← WA Computer Science ATAR Unit 2

Attack surface

All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller surface means fewer ways in.

Part of: WA Computer Science ATAR Year 11 — Cyber Security — Module 10

Understanding Attack surface in WA Computer Science ATAR Unit 2

What it does: Blocking port 23 (Telnet) removes one open port, so the attack surface gets smaller. An attack surface is the sum of all possible entry and exit points, not just one flaw. A running service can be attacked even if nobody uses it, so unneeded services should be disabled. Every active account is a possible way in, so unused accounts should be removed. Each one is a point where an attacker could try to get in or take data out. Reducing entry points gives attackers fewer opportunities to get in. Forgotten accounts often have weak passwords, so each one adds to the attack surface until it is removed.

Common mistakes: The attack surface counts the open ports (entry points), so it should use LENGTH(ports). SUM would add the port numbers together, which is meaningless. Closing an unneeded port shrinks the attack surface, so the code should use ports.remove(21). append adds another entry point instead.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Attack surface to a class →

This module's key terms are also in a printable crossword (Modules 125–266) and word search (Modules 28–266).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which best describes an attack surface?
The single most dangerous bug in a programAll the points where an attacker could try to get in or take data out
Matches
Open ports: 22, 23, 80, 443, 3389 Action: keep every port open just in case
↓
Leaving unneeded ports open widens the attack surface. Only the ports the system needs should stay open and the rest should be closed.
Applying
Meanings
Term
attack surface
Meaning
All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller surface means fewer ways in.
Practice
attack_surface ← open_ports + services + accounts
Testing
Gaps
surface = ports services + accounts
Check Answer
Spots
1ports ← [22, 80, 443, 3389]
2surface ← SUM(ports)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Arctic Fox' badge — Tundra Tracker, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes an attack surface?
A. All the points where an attacker could try to get in or take data out ✓
B. The single most dangerous bug in a program
An attack surface is the sum of all possible entry and exit points, not just one flaw.
2. A server has 3 open ports. After a new service is installed it has 9 open ports. What has happened to its attack surface?
A. It has shrunk, because more ports means more protection
B. It has grown, because there are more points to attack ✓
Every extra open port is another possible way in, so the attack surface gets larger.
3. Which action reduces the attack surface of a web server?
A. Opening extra ports in case they are useful later
B. Closing ports that no service needs ✓
Closing unused ports removes entry points. A smaller surface means fewer ways in.
4. An old FTP service is running on a server but nobody uses it. What should the administrator do?
A. Stop and disable the service to shrink the attack surface ✓
B. Leave it running because unused services cannot be attacked
A running service can be attacked even if nobody uses it, so unneeded services should be disabled.
5. Which of these is an example of a user account adding to the attack surface?
A. A former employee's account that was never deleted ✓
B. A account that has been deleted and no longer exists
Every active account is a possible way in, so unused accounts should be removed.

Match the Pairs

nmap -p- 192.168.1.10 → Scans every port on a device to list the open ports an attacker could try, which maps part of its attack surface
net user → Lists the user accounts on a computer, each of which is a possible way in and part of the attack surface
Reducing the attack surface by closing a port that is not needed → deny tcp any any eq 23
Reducing the attack surface by turning off a running service that nobody uses → systemctl disable --now telnetd
Open ports: 22, 23, 80, 443, 3389 Action: keep every port open just in case → Leaving unneeded ports open widens the attack surface. Only the ports the system needs should stay open and the rest should be closed.
Old accounts: guest, intern2019, test Action: leave them enabled in case they are needed later → Unused user accounts are extra entry points. Unneeded accounts should be disabled or deleted to shrink the attack surface.

Key Term

attack surface
All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller surface means fewer ways in.

Fill in the Blanks

1. surface = ports + services + accounts
Hint: Type the arithmetic operator that adds the counts of open ports, running services and user accounts into one total.
2. openPorts.remove(23)
Hint: Type the list method that takes an item out of the list, closing a way in and shrinking the attack surface.
3. for acct in unusedAccounts: disable(acct)
Hint: Type the keyword that repeats the step once for each unused user account.
4. if len(openPorts) > 5: print("Too big")
Hint: Type the comparison operator that checks whether there are more open ports than the limit.
5. print(openAfter < openBefore)
Hint: Type the comparison operator that checks the attack surface is now smaller than before.

Spot the Error

Question 1
A ports ← [22, 80, 443, 3389]
B surface ← SUM(ports)
C OUTPUT surface
Line B — The attack surface counts the open ports (entry points), so it should use LENGTH(ports). SUM would add the port numbers together, which is meaningless.
Question 2
A ports = [21, 22, 80, 443]
B ports.append(21)
C print(len(ports))
Line B — Closing an unneeded port shrinks the attack surface, so the code should use ports.remove(21). append adds another entry point instead.
Question 3
A svc = ['web', 'ftp', 'db']
B needed = ['web', 'db']
C for s in svc:
D if s in needed:
E print('stop', s)
Line D — Only services that are not needed should be stopped to reduce the attack surface. The test should be 's not in needed'. As written, it would stop the services the system needs.
Question 4
A users = ['guest', 'amy', 'bo']
B # remove unused accounts
C if 'guest' not in users:
D users.remove('guest')
Line C — The condition should check that the guest account exists ('in users') before removing it. With 'not in', the remove line only runs when the account is absent. The unused account stays and keeps widening the attack surface.
Question 5
A FOR EACH account IN accounts
B IF account.active = FALSE
C ENABLE account
D NEXT account
Line C — Inactive user accounts are extra ways in, so they should be disabled to shrink the attack surface. ENABLE would switch on accounts nobody uses.

Student with a class code? Join your class →