Focus Area: Security attack surface analysis and perimeter hardening
This ontology provides citation-quality definitions for 15 foundational terms, backed by authoritative sources from standards bodies (NIST, W3C, IETF, OASIS, ISO) and peer-reviewed research.
Technical Glossary
A continuously reconciled catalog of internet-facing services, endpoints, and management interfaces that could be reached by an external adversary. The inventory is designed to show what is truly exposed now, not merely what the architecture diagram says should be exposed. Teams use it to anchor patching, hardening, and decommissioning decisions to observable surface area.
A hardening program that intentionally shrinks the number of reachable entry points at the edge of the enterprise. It prioritizes removing unnecessary listeners, consolidating remote access paths, and disabling legacy pathways before adding more tooling. The goal is to reduce attacker choice and simplify defensive monitoring.
A reference snapshot of approved public-facing services and ports that defines what normal exposure looks like for a system or business unit. Any deviation from that baseline is treated as either a justified change or an unexplained risk condition. This baseline supports disciplined review of drift over time.
The change that occurs when exposed assets, subdomains, certificates, cloud workloads, or interfaces move outside their approved state without corresponding governance updates. Drift is dangerous because it silently expands exposure faster than human review can keep up. Detecting it early keeps the perimeter from becoming an accidental archive of forgotten systems.
A hardening approach that removes intermediate weaknesses an adversary would chain together after initial exposure is discovered. Rather than treating each flaw in isolation, it identifies how reachable services, weak identity controls, and poor segmentation combine into practical attack routes. Compression reduces the number of viable attack paths to the crown jewels.
A recurring configuration pattern whose failure can expose a large share of the environment, such as a shared firewall template, identity policy, or cloud image baseline. Because one mistake can propagate widely, choke points deserve stricter review and testing than one-off settings. Hardening them yields outsized surface-area reduction.
An integrated set of edge logs, scans, certificate observations, and control-plane signals that provides a living picture of what outsiders can touch. The mesh is meant to close the gap between isolated security tools by correlating exposure evidence across sources. Strong attack surface analysis depends on seeing the same perimeter from more than one angle.
A method for rating how long an externally reachable weakness remains available for exploitation after discovery. It factors in exploitability, asset criticality, reachability, and remediation lag rather than severity alone. This helps teams prioritize exposure that is both open and actionable for attackers.
The portion of the attack surface that remains externally reachable while known corrective patches or compensating controls have not yet been applied. It highlights the practical intersection of vulnerability management and perimeter hardening. Measuring lag as part of surface area turns delay into a visible risk object.
The process of identifying exposed assets that appear in DNS, certificates, scan results, or cloud metadata but do not have clear ownership in the official asset registry. Reconciliation links those assets to a responsible team, retirement decision, or suppression action. It prevents the edge from filling with nobody’s systems.
A perimeter design pattern that limits what newly reached or lightly trusted services can access internally before stronger trust conditions are met. It assumes that some exposed assets will fail and therefore reduces the blast radius available after first contact. Segmentation turns the perimeter into a staged control boundary instead of a single line.
A scheduled reduction campaign that measures and removes unnecessary exposure in a defined period, similar to burning down vulnerability backlog. The focus is on eliminating external access pathways altogether where they are not essential. It creates visible progress against exposure sprawl rather than endlessly documenting it.
The deliberate disabling, isolation, or replacement of externally reachable services that are disproportionately attractive to attackers because of age, privilege, or exploit history. Suppression is different from monitoring because it assumes some services create more risk than value. It is often the fastest way to improve perimeter resilience.
A recurring workflow that confirms whether public-facing systems, ports, certificates, and remote access paths match the approved design at a given time. Verification combines automated observation with human review of business justification. It keeps hardening from becoming a one-time project that drifts into fiction.
A formally documented decision to allow external exposure that violates the normal hardening standard because of a mission, customer, or operational need. The exception records why the exposure exists, what controls compensate for it, and when it must be reviewed again. Mature attack surface programs treat exceptions as temporary risk artifacts, not permanent conveniences.