What is in information safety, what is the surface of the attack?

The attack surface in information security is any area where an unauthorized user can run into the system or input code. This is divided into three areas: network, software and Human Attack surface. While surfaces are technically only a degree of how unauthorized users have access to the system, another attack may come from a trusted employee. There are ways to reduce the attack, such as performing fewer features that users can add code, have less code in general, and divide these features so that only trusted users can access them. Reduction of offensive surfaces does not reduce damage that can cause the attack, only the chances of attacking. Some surfaces can be reduced or eliminated, but some are essential for the success of the program. For example, an input form that allows users to write messages is considered a security threat. At the same time, if there is a program or web web that needs to collect information from users and the user must enter information RThe apprentice, the input field is the only way to allow it.

Attack surfaces are measured in three categories. The surfaces of the network attack are in the network and are mainly due to open ports or drawers or tunnels boring into the net. It is sometimes difficult to find tunnels because they may seem like normal network traffic. The surface of the software attack is any area or function in the program that the user can use, regardless of location or verification.

The surface of the human attack differs from the other two, because network and software surfaces are based on unauthorized users. The human surface includes dissatisfied or ruthless employees who steal or destroy data. If an employee leaves the company and a new employee must gain access to data, it is also considered a security threat, because it is not yet clear how much confidence can be put into a new employee.

a decrease in the surface of the attack varies in z zThe impression of what area is shrinking. For network surfaces, all ports and sockets should be closed to all users other than trustworthy resources. In the software surfaces, the amount of total code should be limited to a minimum and the amount of functions available to unauthorized users should only be limited to a few areas. Reduction of the human surface can be difficult, and this can only be done effectively by giving new employees to a minimum amount of freedom to perform functions until it is trusted.