Attack surface
The sum of all points where an attacker could try to enter or extract data from a system, including hardware ports, radio links, APIs and the supply chain.
Listing the attack surface is the first step of any threat model. For a connected product it includes debug ports such as JTAG and UART on the board, the flash memory that can be read out, the wireless interfaces, the cloud API, the mobile app, the update server, and the people and tools that handle keys during manufacturing. Each one is a possible way in.
Reducing the surface is often cheaper than defending it. Disabling unused interfaces, locking debug access before shipping, removing default credentials and isolating devices through network segmentation all remove options from the attacker rather than guard them. Penetration testing then checks what remains. IoT security fundamentals covers the method.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.