orca.securityarticleAttack Surface Explained: Types & Reduction Tips
A long-form explainer distinguishing attack surface from attack vector and asset inventory, breaking the surface into network/perimeter, identity/permissions, application/code, and data/storage components, and covering how to map it via the OWASP Attack Surface Analysis Cheat Sheet, measure it (Relative Attack Surface Quotient, Carnegie Mellon's attack surface metric), and reduce it. It also contrasts external attack surface management with cyber asset attack surface management and closes with a pitch for Orca's agentless SideScanning and Unified Data Model.
TL;DR Vendor explainer defining and reducing the attack surface across network, identity, app, and data components, grounded in NIST/OWASP references, ending with an Orca ASM product pitch.
Organisations named here
- Attack Surface Red Agent
- NIST SP 800-160
- Relative Attack Surface Quotient
Technologies named here
- Amazon S3
- Orca SideScanning
- Orca Unified Data Model
- AWS Network Access Analyzer
- Orca Sensor
- Microsoft Defender for Endpoint
- Orca Attack Surface Red Agent
- Amazon S3 Block Public Access
- OWASP Attack Surface Analysis Cheat Sheet
- AWS
- Orca Security
Techniques named here
- Attack surface analysis / reachability testing
- Attack path analysis
- Stale DNS record exploitation
- Public S3 bucket policy misconfiguration
Related in Cloud & Infra
orca.securityarticleOrca Security: GenAI Risks in Cloud Environments
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
attackthesoc.comarticle