Attack surface

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes an attack surface?

A All the points where an attacker could try to get in or take data out

B The single most dangerous bug in a program

2. A server has 3 open ports. After a new service is installed it has 9 open ports. What has happened to its attack surface?

A It has shrunk, because more ports means more protection

B It has grown, because there are more points to attack

3. Which action reduces the attack surface of a web server?

A Opening extra ports in case they are useful later

B Closing ports that no service needs

4. An old FTP service is running on a server but nobody uses it. What should the administrator do?

A Stop and disable the service to shrink the attack surface

B Leave it running because unused services cannot be attacked

5. Which of these is an example of a user account adding to the attack surface?

A A former employee's account that was never deleted

B A account that has been deleted and no longer exists

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1nmap -p- 192.168.1.10		AScans every port on a device to list the open ports an attacker could try, which maps part of its attack surface
2net user		Bdeny tcp any any eq 23
3Reducing the attack surface by closing a port that is not needed		CUnused user accounts are extra entry points. Unneeded accounts should be disabled or deleted to shrink the attack surface.
4Reducing the attack surface by turning off a running service that nobody uses		Dsystemctl disable --now telnetd
5Open ports: 22, 23, 80, 443, 3389 Action: keep every port open just in case		ELeaving unneeded ports open widens the attack surface. Only the ports the system needs should stay open and the rest should be closed.
6Old accounts: guest, intern2019, test Action: leave them enabled in case they are needed later		FLists the user accounts on a computer, each of which is a possible way in and part of the attack surface

Definitions

attack surface

Fill in the Blanks

Complete each line of code by filling in the missing parts.

surface = ports _ services + accounts

openPorts.______(23)

___ acct in unusedAccounts: disable(acct)

if len(openPorts) _ 5: print("Too big")

print(openAfter _ openBefore)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A ports ← [22, 80, 443, 3389]

B surface ← SUM(ports)

C OUTPUT surface

Question 2

A ports = [21, 22, 80, 443]

B ports.append(21)

C print(len(ports))

Question 3

A svc = ['web', 'ftp', 'db']

B needed = ['web', 'db']

C for s in svc:

D if s in needed:

E print('stop', s)

Question 4

A users = ['guest', 'amy', 'bo']

B # remove unused accounts

C if 'guest' not in users:

D users.remove('guest')

Question 5

A FOR EACH account IN accounts

B IF account.active = FALSE

C ENABLE account

D NEXT account

Answer Key

Attack surface

Section A: Quick Questions

A — All the points where an attacker could try to get in or take data out

B — It has grown, because there are more points to attack

B — Closing ports that no service needs

A — Stop and disable the service to shrink the attack surface

A — A former employee's account that was never deleted

Section B: Match the Pairs

nmap -p- 192.168.1.10 → Scans every port on a device to list the open ports an attacker could try, which maps part of its attack surface

net user → Lists the user accounts on a computer, each of which is a possible way in and part of the attack surface

Reducing the attack surface by closing a port that is not needed → deny tcp any any eq 23

Reducing the attack surface by turning off a running service that nobody uses → systemctl disable --now telnetd

Open ports: 22, 23, 80, 443, 3389 Action: keep every port open just in case → Leaving unneeded ports open widens the attack surface. Only the ports the system needs should stay open and the rest should be closed.

Old accounts: guest, intern2019, test Action: leave them enabled in case they are needed later → Unused user accounts are extra entry points. Unneeded accounts should be disabled or deleted to shrink the attack surface.

Section C: Definitions

attack surface — All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller surface means fewer ways in.

Section D: Fill in the Blanks

surface = ports + services + accounts

openPorts.remove(23)

for acct in unusedAccounts: disable(acct)

if len(openPorts) > 5: print("Too big")

print(openAfter < openBefore)

Section E: Spot the Error

B — The attack surface counts the open ports (entry points), so it should use LENGTH(ports). SUM would add the port numbers together, which is meaningless.

B — Closing an unneeded port shrinks the attack surface, so the code should use ports.remove(21). append adds another entry point instead.

D — Only services that are not needed should be stopped to reduce the attack surface. The test should be 's not in needed'. As written, it would stop the services the system needs.

C — The condition should check that the guest account exists ('in users') before removing it. With 'not in', the remove line only runs when the account is absent. The unused account stays and keeps widening the attack surface.

C — Inactive user accounts are extra ways in, so they should be disabled to shrink the attack surface. ENABLE would switch on accounts nobody uses.