Chapter 3 Attack Surfaces

Attack Surface Components

• Cyber (over the wire)

• Physical (Touch)

• Wetware (Human error or risk)

• Third Party

Attack Surface Components: Cyber (over the web)

• Internet exposed services
• Valid Creds
• Software and Services
• Malware
• Internal Networks
• APIs
• Edge Devices / IoT
• Endpoints
• BYOD

Attack Surface Components: Physical (Touch)

• Systems or Facilities Access

• Hardware Theft

• Public Kiosks

• Dropper Attacks

• USB

• QR Code

Attack Surface Components: Wetware (Human error or risk)

• Malicious Insiders

• “Unwitting” Insiders

• Social Engineering

• Mistakes

Attack Surface Components: Third Party

• Cloud resources
• Service Hosting
• Data Processing
• Network or systems Access.
• Supply Chain
• Shadow IT

Social Engineering

• Attacks targeting the intersection of human and cyber / physical attack surfaces.

• Psychological manipulation to trick users into making security mistakes or giving away sensitive information.

• Can involve physical, real world or digital tactics

Phishing

Email, text, DM, etc. aimed at tricking victim by creating a sense of
urgency, curiosity or fear in victims.

Scareware

bombarded with false alarms and fictitious threats

Spear Phishing

Targeted attacks. A perpetrator first investigates the intended victim to gather necessary background information.

Common Vulnerability Enumeration (CVE)

Program to uniquely identify, define, and catalog publicly disclosed cybersecurity vulnerabilities

CVE-[4 digit year]-sequence identifier]

• Vulnerabilities are discovered then assigned and published by organizations from around the world that have partnered with the CVE Program.

• Partners publish CVE Records to communicate consistent descriptions of vulnerabilities.

• Information technology and cybersecurity pros use CVE Records to ensure they are discussing the same issue, and to coordinate their efforts to prioritize and address the vulnerabilities

Common Weakness Enumeration (CWE)

Community-developed list of common software and hardware weakness types that could have software ramifications

• A weakness is a condition in a software, firmware, hardware, or service component that, under certain circumstances, could contribute to the introduction of vulnerabilities.

• CWEs represent the root causes of CVE Records

Common Vulnerability Scoring System (CVSS)

Produces a numerical score to represent the severity of a vulnerability

• The numerical score can then be translated into a qualitative representation (such as low, medium, high, and critical) to help organizations properly assess and prioritize their vulnerability management processes

Evaluating Vulnerability Impact - CVSS

Exploitability Metrics

• Attack Vector – Can this be exploited remotely? Is a valid user account needed?

• Complexity – how difficult is the exploit to reproduce

• Privileges Required – Admin privs needed? No credentials needed at all?

• User interaction required – does the attacker need to “recruit” a user?

• Opportunity for privilege escalation.

• Impact – includes confidentiality, integrity and availability

Evaluating Vulnerability Impact - CVSS

Temporal

How has the vulnerability changed over time?

• Exploit code maturity - How mature are existing exploit methods; does an exploit even exist?

• Remediation level - Is there a patch or (temporary) workarounds to mitigate the vulnerability

• Report confident – level of validation in demonstrating the above metrics or threat accuracy

NIST’s National Vulnerability Database (NVD)

(NVD) has – us gov’t repository of vulnerabilities and threat scores.

• While duplicative with CVE, this enriches CVE information with:

  • Tunable and interactive CVSS scores (severity ratings)

  • Impact metrics (confidentiality, integrity, availability)

  • Fix information, references, and links to patches or advisories.

Scores - CVSS Qualitative ratings

0.0 – none

0.1 – 3.9 – Low

4.0 – 6.9 – Medium

7.0 – 8.9 – High

9.0 – 10.0 – Critical

Con of CVE & CVSS

CVE and CVSS are good at quantitative / qualitatively defining single, specific vulnerabilities, but do not do a good job at providing complete organizational context. This is where vulnerability management comes in!

Vulnerability Management

the continuous, cyclical, process of identifying, evaluating, prioritizing, and remediating security weaknesses in an organization's systems and software, before adversaries can exploit them.

vulnerability management process

Not a one-time scan-and-patch event; it's an operational program with a recurring lifecycle which includes:

• Discover – Inventory assets and identify vulnerabilities across them (scanning, CVE/CWE tracking, code analysis, exposure discovery).

• Assess – Determine severity and real-world exploitability, not just theoretical risk. Some alerts may be false positives or exceptions.

• Prioritize – Decide what to fix first, given finite time and resources. Involves setting thresholds driven by: Data risk, CVSS scores

• Remediate – Patch, reconfigure, or mitigating where patching isn't Immediately possible.

• Verify & Monitor – Confirm the fix worked and continue watching for new exposures, since the landscape never stops changing.