阅读中文版本

Attack Surface Mapping Workflow

Enumerate externally reachable services and entry points so exposure can be reduced deliberately rather than discovered by attackers.

Overview

Maintain an accurate map of externally reachable assets and entry points.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• Asset inventory
• Network exposure data
• DNS and certificate records

Procedure

1. Enumerate external endpoints

List public DNS names, certificates, and load balancers that expose services.

Expected state: A full list of external entry points exists.

2. Identify unnecessary exposure

Flag services exposed that do not need to be public.

Expected state: Reducible exposure is identified.

3. Reduce the surface

Close, restrict, or move services behind authentication as appropriate.

Expected state: Exposure matches business need.

4. Keep the map current

Re-derive the map on a schedule and on infrastructure changes.

Expected state: The map reflects current reality.

# enumerate public certificates as an exposure signal
cat transparency-log.json | jq -r '.[] | select(.issuer)
.name' | sort -u

Verification

Confirm the enumerated surface matches the intended architecture and flagged exposures were addressed.

Decision points

Keep legacy endpoints or retire them?

• Retire unused public endpoints
• Keep for compatibility

Recommendation: Retire unused public endpoints; they are pure risk.

Authenticate or restrict by network?

• Authenticate by default
• Network restriction where feasible

Recommendation: Default to authentication and add network restriction where feasible.

Common failures

• Forgotten endpoints stay exposed for years.
• Discovery by attackers precedes discovery internally.
• Stale maps cause false assurance.