Attack Surfaces and Exposures

What it is

Not every weakness is a bug in code. Many breaches come from things that are exposed by accident: old accounts, devices nobody approved, services set up without the security team, or data left open to the public.

This page covers those attack surfaces. They share one feature: the organization often does not know they exist until an attacker finds them.

How it works

Unmanaged and stale credentials

Stale credentials belong to accounts that are no longer needed, such as former staff, finished projects or old service accounts. Unmanaged credentials are ones no one tracks, such as shared logins or keys created and forgotten.

Nobody notices when these accounts are used, which makes them ideal for attackers. Regular access reviews, automatic deprovisioning when people leave and rotation of service account secrets close the gap.

Rogue devices

A rogue device is any unauthorized device connected to the network, such as a personal access point, a small computer hidden behind a desk or an unapproved switch. It can bypass network controls or give an attacker a foothold.

Network access control, port security and wireless scanning detect and block rogue devices.

Shadow IT

Shadow IT is the use of hardware, software or cloud services without the approval of the IT or security team. It is usually done for convenience, not malice.

The risk is visibility. Data stored in an unapproved service is outside backups, monitoring, patching and data protection policy.

Wireless and low-powered communications

Low-powered wireless protocols connect sensors, smart devices and wearables. These devices have little processing power and battery, so encryption and authentication are often weak, optional or switched off.

Weak pairing, default keys and lack of updates are common problems. Treat such devices as untrusted and segment them from important systems.

Large language models (LLMs)

An LLM added to a business process becomes part of the attack surface. Users may paste sensitive data into it, attackers may hide instructions in content it reads, and its output may be trusted without checking.

The last page of this chapter covers the threats and vulnerabilities of AI usage in detail.

Identity providers

An identity provider (IdP) authenticates users for many applications through single sign-on. That makes it a single point of failure: compromise the IdP, or an administrator account on it, and the attacker reaches every connected application.

Protect IdP administrator accounts with phishing resistant MFA, monitor IdP configuration changes and limit who can create trusts or tokens.

Mobile devices

Mobile device management (MDM) can detect jailbroken or rooted devices, enforce encryption and a screen lock, and wipe a lost device.

Misconfiguration

Misconfiguration means settings that expose a system even though the software works as designed. Examples are default passwords, open ports, overly broad permissions and debug features left on.

It is one of the most common causes of breaches. Secure baselines, configuration scanning and change control reduce it.

Public repositories

Code shared in public repositories can expose secrets, internal hostnames and the design of systems. Attackers scan public repositories automatically for keys and passwords within minutes of a push.

Public package repositories bring a second risk: a malicious or compromised package added as a dependency. Scan code for secrets before it is pushed, and vet the packages you use.

Public object storage

Cloud object storage, such as a storage bucket, can be set to allow public access. A bucket opened by mistake can expose large amounts of data to anyone who finds its address.

Under the shared responsibility model, the customer owns this setting, not the cloud provider. Block public access by default and alert on any change.