Attack Surface and Monitoring Data Sources

What it is

The attack surface is everything an attacker could try to reach, and each monitoring technology records a different slice of what happens there.

A vulnerability is one specific weakness. The attack surface is the larger collection of exposed systems, services, accounts and people where such weaknesses could be used.

Analysts need to know which tool produces which kind of data, because that decides what questions they can answer.

How it works

Reducing the attack surface lowers exposure, and each data source adds a different view for detection.

Attack surface versus vulnerability

You reduce the attack surface by removing what is not needed. Close unused ports, turn off unused services, remove old accounts and limit who can reach what. A smaller surface means fewer places for a vulnerability to matter.

You reduce vulnerabilities by patching, fixing configuration and testing. Both actions help, and they are different jobs.

Data from packet capture: tcpdump

tcpdump is a command line packet capture tool. It records the actual packets on an interface, including the payload when it is not encrypted.

sudo tcpdump -i eth0 -nn host 10.1.1.5 and port 80
sudo tcpdump -i eth0 -w capture.pcap
tcpdump -r capture.pcap

The first command shows packets for one host and port. The second saves packets to a file. The third reads a saved file.

The -nn option stops name and port lookups.

Data from NetFlow

NetFlow is information about conversations, not packets. A flow record summarises a conversation using values such as the source and destination addresses and ports, the protocol, packet and byte counts, and the start and end times.

It is small and cheap to keep for a long time. It shows who talked to whom, when and how much, but it does not hold the payload.

Data from firewalls

A traditional stateful firewall tracks connections and logs them. Its records show addresses, ports, protocol, and whether the connection was allowed or denied. It does not understand applications.

A next generation firewall (NGFW) adds more. Its data can include the identified application, the user, the result of intrusion prevention checks, URL categories and file or malware verdicts.

Data from application visibility and control

Application visibility and control (AVC) identifies applications even when they share a port, for example a video service running over HTTPS. Its data shows which applications are used, by whom and how much bandwidth they take. It also lets a policy allow, limit or block a specific application.

Data from web and email content filtering

Web content filtering checks requested websites against categories and reputation. Its logs show the user, the URL, the category and whether the request was allowed or blocked. This helps find visits to malicious or inappropriate sites.

Email content filtering inspects incoming and outgoing messages. Its logs show senders, recipients, subjects, attachments and verdicts such as spam, phishing or malware. This helps trace a phishing campaign to every mailbox that received it.