Attack Surfaces - The Key To An Effective Threat Mitigation Strategy

In cybersecurity, staying one step ahead of potential threats is nirvana; it’s the reality we all want to live in and the dream we’ve all had (maybe just me on that last part).

I’ve written about threat modelling before, using the ATASM method originally detailed in Brook Schoenfield’s book “Securing Systems”, but here’s a quick refresher.

Threat modelling is an important exercise that helps organisations proactively identify threats and vulnerabilities and strengthen their defences by focusing on the adversarial side of security to provide effective mitigation strategies.

At the heart of this process lies the concept of "attack surfaces," a fundamental element that forms the foundation of effective threat modelling.

Key takeaways (TL;DR):

Threat Modelling is critical for understanding your technical environment and developing a threat mitigation strategy with precision.
Attack surfaces are the key to forming a complete picture of your end-to-end threat landscape, as they highlight the entry paths for potential cyber-attacks.
The goal is not to remove attack surfaces (although, in some cases, you might be able to) but to ensure the most effective mitigations are in place to reduce the risk of a successful attack.
Standardisation is often necessary to produce accurate and repeatable results but comes at the cost of reducing flexibility and adaptability to new requirements.

In this article, I will explore the drawbacks and potential benefits of well-defined attack surfaces, propose a straightforward solution for classifying them, and showcase their real-world application in developing an effective threat mitigation strategy using a walkthrough example.

Understanding Attack Surfaces in Threat Modelling

What is an Attack Surface in Cyber Security?

Attack surfaces are the virtual battlegrounds where potential cyber threats interact with your systems, applications, networks and even you. These surfaces encompass all the entry points an attacker might exploit to compromise your digital assets. See NIST’s definition here.

Understanding these attack surfaces in threat modelling is crucial, as it allows you to identify vulnerabilities in your environment and devise effective mitigation strategies.

A Case for Categorisation

One of the primary challenges when using attack surfaces in threat modelling is the lack of categorised attack surfaces. This inconsistency in terminology and categorisation can impact the result of the threat model, potentially missing some obscure vulnerabilities and hindering communication among security professionals and business leaders responsible for protecting sensitive information within the organisation.

Without a system for classifying attack surfaces, the process becomes more subjective, leading to potential misunderstandings and inaccurate prioritisation of security measures.

However, considering the other side of the argument, some benefits come from having no defined standards. Here are some of the benefits that spring to mind:

Flexibility and Adaptability: Lack of standardisation makes threat modelling more flexible and adaptable to unique circumstances. Organisations may have specific requirements or systems that do not neatly fit into standardised attack surface categories. In such cases, a lack of rigid classifications allows customised approaches to better address an organisation's needs.

Creativity and Innovation: Security professionals have more freedom to think creatively and innovatively when identifying potential attack vectors without strict standards. This can lead to discovering new vulnerabilities and unique solutions that may not have been considered within standardised approaches.
Tailored Risk Assessment: Non-standardised threat modelling can accommodate a more tailored threat/risk assessment. Organisations may have different risk tolerance levels, and not all vulnerabilities carry the same weight. Sometimes, a lack of standardisation can help organisations prioritise risks based on their unique risk appetite and requirements.

My goal for introducing a classification system is to reduce the time and complexity involved in producing threat-informed defence strategies while increasing the overall effectiveness based on attack surfaces that map directly to attack techniques and mitigating controls.

The attack surface categories I will use here will provide a repeatable process for producing a robust set of layered defence strategies (defence-in-depth) applicable to the entire user and technology landscape.

Classifying Attack Surfaces for Effective Threat Mitigation

Attack Surface Classifications - NISA

This solution involves defining attack surfaces across four key categories:

Network. The network attack surface refers to the points in a system or application where it interacts with other systems or networks. It includes all entry and exit points where data flows into or out of the system or application, such as ports, protocols, and network services.

Identity. The identity attack surface encompasses all elements related to user and system identities, including authentication mechanisms, user accounts, access controls, and privilege levels. It represents the points of vulnerability where an attacker may attempt to compromise or impersonate user or system identities to gain unauthorised access or privileges.

System. The system attack surface includes physical hardware and software components, including servers (virtual and physical), routers, printers, load balancers, operating systems, services, and configurations. The system attack surface also encompasses end-user devices such as laptops, smartphones and TVs.
Application. The application attack surface relates to software applications, including web, desktop, mobile and their components. It includes interfaces, input validation, APIs, and external dependencies.

We create a standard set of variables to map against threat techniques and mitigating controls by classifying attack surfaces into these four distinct areas.

Using Attack Surfaces to Enumerate Threats and Mitigations

Real-world Example

In this example, I will run through a tool I created that produces a comprehensive list of threat techniques and their mitigating controls. The tool can filter results based on any of the below selections.

Attack Surface

Network
Identity
System
Application

Technique

Threat ID
Technique

Mitigation

Mitigation ID
Mitigation

The logic behind mapping threat techniques and mitigations to attack surfaces is based on the statements below.

A threat technique requires an attack surface to attack or compromise.
A mitigating control requires an attack surface to mitigate or safeguard.

For this example, I am using the ATT&CK technique database and the list of enterprise mitigations from MITRE. The raw data has been enhanced to create a relationship between techniques, mitigations and attack surface.

The first screen shows the number of threat techniques categorised by their related attack surface.

Note: This tool is still a work in progress. The final numbers and total percentages will differ once all the data has been processed.

In the screen below, we can filter the techniques by their corresponding attack surface(s). Here, I am filtering the techniques by ‘network’. The result is the complete list of network-based threats and their associated mitigating controls (top-right).

The techniques above can also be filtered by platform (Windows, MacOS, Linux… etc.) or data source for more specific attack techniques and control evaluation.

Sticking with the network attack surface in this example, this next screen focuses on the mitigating controls for specific techniques. Here, I have selected “Exfiltration Over Web Service”, and we can see the network controls available to mitigate this technique.

Some techniques can and often do have more than one attack surface; for example, “Email Account Compromise” (shown below) will primarily start as an identity-based attack but can lead to system compromise. For this reason, I have created a one-to-many link between the techniques that contain more than one susceptible attack surface to provide mitigations across the entire threat landscape.

In these last two screens, we see the “Email Account” technique with a list of mitigating controls for both “identity” and “system” attack surfaces.

Mitigations by technique and attack surface (identity)

Mitigations by technique and attack surface (system)

Using the above list of mitigations, we can further plan, develop and implement an effective threat mitigation strategy aligned with the defence-in-depth principle.

As part of a more extensive threat modelling exercise, what would generally be a complex task, identifying all the possible attacks and mapping each to their respective attack surface, is now achievable in just a few clicks.

Lastly, using this tool, in combination with threat modelling, we can achieve a highly resilient state of security using threat-informed defence.

Notes, Observations and Credits:

As mentioned earlier, this tool is still a work in progress. I plan to enable support for additional industry-standard control libraries such as NIST 800-53, ASD ISM, CSA CCM, etc.
I plan on releasing this tool (once I’ve got it to a point of completion). Stay tuned, and I’ll be sharing the finished product soon!
Unsurprisingly, the system attack surface contains the highest number of techniques. This is due to the many different ways an operating system can be compromised. Some interesting CVE information has been published here if you would like to read more about this.
Although the tool greatly simplifies identifying attack techniques and associated mitigations based on attack surfaces, it doesn’t remove the need for further analysis regarding the more complex attack scenarios and unique business requirements.
Credit goes to the MITRE ATT&CK team for their in-depth work and effort in producing and maintaining the list of attack techniques for which this tool is leveraging.