Study Guide
Attack Surfaces and Attack Vectors
Where an attacker could get in and the routes they use: mapping an attack surface, software, network, message-based and supply-chain vectors, compensating controls for systems that cannot be patched, agent-based and agentless scanning, Stuxnet, and how to reduce the surface.
Lesson 2.8 Threats, Vulnerabilities & Defence
A burglar looking at a house sees more than the front door. This lesson is about seeing an organisation in the same way, naming what you find, and what defenders do about it.
Stage: Think
Every way in
Think it through
Look at a house as a burglar would. List every place where an entry could be attempted.
- Hint 1: Start with the obvious ways in, then think about the less obvious ones.
- Hint 2: Could a person, rather than an opening, be a way in?
Show what happens
Doors, windows, the garage, a side gate, the key under the flowerpot, even a delivery driver who is let in. That whole set of possibilities is one idea. The single way actually used on the night is another.
Think it through
Show the answer
Answer: C. No: it is one route; the rest still count.
The gate was the route used. The doors, windows and the key under the flowerpot are still there. Security names both ideas, as the next step shows.
Stage: Explain
Surface and vector
The attack surface is the total set of possible points where an attacker can interact with, or attempt to compromise, an organisation, a system or an application.
An attack vector is the route or method an attacker uses to reach the target. “Threat vector” means the same thing.
A memory aid:
- Attack surface = every point they could get in or interact with.
- Attack vector = the route or method they use.
A short example for one organisation:
| Attack surface (possible points) | Attack vectors (routes used) |
|---|---|
| The VPN portal | Stolen VPN credentials |
| The email system | Phishing |
| The public website | A web exploit |
| Employees | Social engineering |
Do not confuse: Attack surface and attack vector
- Where?Attack surface
- The possible points of attack. A set of places.The VPN portal, the email system, the website, the staff.
- How?Attack vector
- The route or method used. A path through one of those places.Stolen credentials presented at the VPN portal.
The surface depends on what you are assessing
An attack surface can include physical access points, network infrastructure, applications, application programming interfaces (APIs), cloud services, users, remote-access systems, devices, wireless networks and relationships with third parties.
It is always relative to what is being assessed. The scope can be:
- an organisation: every site, system, person and supplier;
- a system: one server, with its services, accounts and connections;
- an application: its sign-in page, its forms, its APIs and the files it accepts.
So “the attack surface” is not one fixed thing. Say what you are measuring first.
Stage: Experiment
Mapping an attack surface: a water and power company
Suppose a fictional company supplies water and electricity to a region. The question is simple: how could an attacker get in? Working through the organisation area by area gives a map.
Think it through
Before you look at the map: name at least four different areas of a water and power company where an attacker might try to get in.
- Hint 1: Think of people, technology, buildings and other companies.
- Hint 2: What do staff use to work from home?
Show what happens
Most lists include people, the website, remote access and the buildings. The map adds applications, cloud services and suppliers, and gives an example route through each.
An original diagram for defensive learning. Each area lists points an attacker could reach, which together form the surface, and one example route in, which is a vector.
The organisation (fictional)
Regional water and power company
Offices, treatment works, substations, control rooms, staff and suppliers.
People
Points that could be reached
- Staff and contractors
- Email accounts
- Telephone lines
Example vector: a phishing email or a deceptive phone call.
Applications
Points that could be reached
- The public website
- The customer billing portal
- APIs used by partners
Example vector: exploiting a flaw in a web application.
Network
Points that could be reached
- VPN and remote access
- Internet-facing devices
- Wireless networks
Example vector: stolen credentials used at the VPN.
Physical
Points that could be reached
- Offices and control rooms
- Unstaffed substations and pumping stations
- USB ports on equipment
Example vector: an infected removable drive carried on site.
Cloud
Points that could be reached
- Hosted email
- Cloud storage
- Management consoles
Example vector: access to a storage service left open to the internet.
Suppliers
Points that could be reached
- Maintenance firms with remote access
- Software vendors
- Managed service providers
Example vector: a compromised supplier account used for remote support.
The map is a way of asking questions, not a list of faults. Finding a point on the surface does not mean it is weak; it means it must be known, owned and protected.
A fuller list for such a company would cover internet-facing systems, VPN and remote access, email and users, third-party access, physical facilities, wireless, applications and APIs, cloud services, removable media, and the industrial systems that run the plant.
Where IT meets operational technology
A utility has two kinds of technology, and the place where they meet matters.
- IT (information technology) runs the business: email, billing, staff laptops.
- OT (operational technology) monitors and controls physical processes: pumps, valves, switchgear.
- ICS (industrial control systems) is the general name for the systems that do that controlling.
- SCADA (supervisory control and data acquisition) lets operators monitor and control equipment spread across a wide area from a central control room.
- A PLC (programmable logic controller) is the rugged computer that directly drives a machine.
- An engineering workstation is the computer used to program and configure PLCs.
The engineering workstation is a bridge: it is an ordinary computer, often running Windows, that can change how physical equipment behaves. An attacker who reaches it from the IT side has a route into OT. That is why the links between IT and OT are an important part of a utility’s attack surface, and why an incident there can affect the physical world and public safety, not only data.
Stage: Predict
A vector is a route and a weakness makes it usable
Think it through
A route on its own harms nobody. It becomes dangerous when there is a weakness along it. Keeping the two apart makes it clear what to fix.
Vector and weakness side by side
| Vector (the route) | Weakness (what makes the route exploitable) |
|---|---|
| VPN remote access | Default credentials, or missing MFA |
| A network service exposed on an open port | A vulnerable or misconfigured service |
| Staff who have not been shown how to spot a deceptive message, and no filtering | |
| Removable media | Computers that run whatever is plugged in |
You can respond to either side. Close the route (remove the service, block the port) or fix the weakness (patch, add MFA, change the default password). Often you do both.
Stage: Predict
Vulnerable software vectors
Software is a route in whenever it has a weakness an attacker can reach. The weaknesses come from several places:
- Faults in code: a programming mistake, such as failing to check input.
- Faults in design: the software works as written, but the design itself is unsafe.
- Delayed patching: a fix exists but has not yet been applied.
- Difficult patching: the system cannot easily be taken offline or updated, as with much industrial equipment.
- Unsupported systems and applications: the vendor no longer provides security fixes, so newly discovered weaknesses stay open permanently.
- Legacy systems: older systems that are still in use and often cannot run modern security features.
Vulnerabilities and Exposure explains how known vulnerabilities are catalogued and why exposure matters as much as the flaw.
Compensating controls for systems that cannot be patched
Think it through
A server runs software its maker no longer supports, and it cannot be replaced this year. If you cannot patch it, what else could you do?
- Hint 1: Who and what needs to reach this server at all?
- Hint 2: How would you know if it were being misused?
Show what happens
Make the weakness harder to reach and its misuse easier to notice: put the server in its own part of the network, allow only the connections it needs, cut who can use it, and watch it closely. Measures like these have a name.
The preferred answer to an unsupported or legacy system is to patch it or replace it. Sometimes neither is possible: the equipment is too costly to replace, or it runs a process that cannot stop.
A compensating control is an alternative security measure used when the preferred control cannot be implemented.
Problem: a legacy server runs software the vendor no longer supports. It cannot be patched.
Preferred control: patch it or replace it. Neither can happen this year.
Compensating controls:
- Network segmentation: move it to its own part of the network.
- Firewall restrictions: allow only the few connections it needs.
- Least privilege: cut the accounts that can use it to the minimum.
- Restricted access: allow administration only from named, trusted computers.
- Monitoring and logging: watch it more closely than an ordinary server.
None of these fixes the server’s weakness. Together they make the weakness much harder to reach and misuse easier to notice.
Security Controls: Categories and Functions explains why a compensating control must stand in for a specific control and is not simply extra security.
Agent-based and agentless scanning
To find vulnerable software, organisations run vulnerability scanning: automated checks of devices for known weaknesses and unsafe settings. There are two ways to deploy it.
Agent-based. A small software component, an agent, is installed on each endpoint and reports what it finds.
- Advantages: deeper local visibility; it can inspect configuration and installed software directly; and it is useful for devices that are only intermittently connected, such as laptops used away from the office.
- Trade-offs: the agents have to be deployed and kept up to date on every device.
Agentless. No dedicated scanner agent is installed on the target. The scanner examines it remotely, by signing in over the network with the remote-management features the device already has.
Go deeper Which remote-management features an agentless scanner uses
- SSH (Secure Shell): the standard way to sign in remotely to Linux computers and network devices.
- WinRM (Windows Remote Management) and WMI (Windows Management Instrumentation): the Windows equivalents.
- SNMP (Simple Network Management Protocol): used to ask network equipment about its own state.
- APIs (application programming interfaces): the connections a product offers for other programs to query it.
The names matter less than the idea: the scanner uses a door that is already there, so it needs the network path and the credentials to open it.
- Advantages: easier to deploy from one central point, and less software on each endpoint.
- Trade-offs: what it can see depends on network reachability and on the credentials it has been given. A device that is switched off, or off the network, is not scanned.
Do not confuse: Agent-based and agentless scanning
- Agent-based
- A small component is installed on the device and reports from the inside.Deep visibility; works for devices that come and go; must be deployed and maintained.
- Agentless
- Nothing dedicated is installed; the scanner connects remotely.Easy to deploy centrally; sees only what it can reach and sign in to.
Check your understanding
Show the answer
Answer: C. Agent-based: it reports from the device.
Agent-based: the agent reports from the laptop itself. An agentless scanner sees only what it can reach and sign in to.
Do not confuse an agent with a thick client. An agent is a small background component that monitors or manages a device. A thick client is a full application installed on the computer that does substantial processing locally, such as a desktop accounting package. Both are installed software, but they exist for different reasons.
Stage: Check
Network vectors
The network offers several distinct kinds of route:
- Local or direct access: being connected to the same network, or plugging into a network socket in the building.
- Remote access: VPNs and remote-desktop services intended for staff.
- Wireless: Wi-Fi that reaches beyond the walls.
- Cloud: services reached over the internet instead of from inside the building.
- Unsecured networks: public or poorly protected networks that staff connect through.
- Default credentials: the username and password a device ships with, never changed.
- Open service ports and exposed network services: services listening where anyone can reach them.
- Remote-management interfaces: administration pages for routers, firewalls and servers left reachable from outside.
Notice that this list mixes routes and weaknesses. “Remote access” is a route. “Default credentials” is a weakness that makes a route usable. Separating them, as in the table of vectors and weaknesses, tells you what needs to change. Service Discovery and Vulnerability Research shows how open ports and services are identified.
Check your understanding
Show the answer
Answer: B. A router’s unchanged factory password.
The factory password is a weakness. Remote access and Wi-Fi are routes; a weakness like that password is what makes a route usable.
Stage: Predict
Message-based vectors
Many attacks arrive as a message. The channels are email, SMS text messages, instant messaging, web and social media, and voice calls.
Think it through
A phishing email contains a link to a fake sign-in page. What was the vector: the email, the link, or the deception?
- Hint 1: How did the attack reach the person?
- Hint 2: What did the message carry? What made the person act?
Show what happens
Each of them, depending on how closely you describe the attack. The levels are set out below.
The word vector is used at more than one level of detail, and sources do not all stop at the same level. Take a phishing email with a link to a fake sign-in page:
- the channel: how the attack reaches the person. Email, SMS, a voice call, social media;
- the delivery mechanism: what the message carries. A malicious link, an attachment, a request for credentials;
- the social-engineering technique: the deception that makes the person act. Phishing, impersonation, pretexting.
Each of these is called a vector in everyday and professional use, and each is a fair answer to “how did the attacker get in?” at its own level. A shortcut keeps them apart: the communication channel is the route, and the link, attachment or deception is what travels along it. So when a source speaks of a message-based vector, it is naming the channel.
The shortcut sorts the levels. It does not make the other uses wrong: a report that calls a malicious link, or phishing itself, “the vector” is describing the same attack more closely.
Channels and the names used for phishing over them
| Channel (the vector) | Name commonly used |
|---|---|
| Email and messages generally | Phishing |
| SMS text message | Smishing |
| Voice call | Vishing |
| Social media or instant messaging | Social-media or instant-messaging phishing |
Social Engineering and Phishing explains each of these and the deception behind them.
Stage: Predict
The supply chain as an attack surface
An organisation’s attack surface does not stop at its own walls. Every supplier, service and piece of third-party software extends it. This part of the surface is hard to manage because of its complexity and reach: a single organisation may depend on hundreds of suppliers, each with suppliers of its own.
The supply-chain surface includes:
- third-party dependencies;
- weaknesses in procurement, where products and suppliers are chosen without security checks;
- supplier access to systems or data;
- managed service providers (MSPs), which run IT for many customers at once;
- software vendors;
- software dependencies and libraries built into other products;
- remote-support relationships.
Think it through
Show the answer
Answer: C. No: they went round them, through something trusted.
They went round the defences: the company accepted the update because it came from a trusted source. That kind of attack has a name.
A supply-chain attack is one in which an attacker reaches the target through a trusted supplier, vendor or dependency.
An original diagram. The attacker never has to defeat the target's own defences directly; the route in is something the target already trusts.
- Attacker
Wants access to the target, but the target is well defended.
- Supplier, vendor or dependency
The attacker compromises something the target relies on: a software vendor, a managed service provider or a code library.
- Trusted relationship
The compromise travels along an existing, trusted route: a software update, a remote-support connection or a supplier account.
- Target
The target accepts it, because it comes from a source it trusts.
Examples of the trusted route being abused:
- a compromised software update;
- breached supplier credentials;
- a compromised managed service provider;
- a tampered dependency or library.
Not every third-party incident is a supply-chain attack. If a supplier is breached and its own data is stolen, that is an incident at the supplier. It becomes a supply-chain attack on its customer when the trusted supplier, vendor or dependency relationship is abused as the route into the target.
The defensive aim is sometimes summed up as “denying opportunity”. Stated professionally, it means reducing the opportunities open to an attacker through supplier assurance, least privilege, segmentation, secure procurement, monitoring and restricted third-party access. Third-Party and Supply-Chain Risk covers how supplier risk is managed from selection to exit.
Stage: Explain
A real example: Stuxnet
Stuxnet is malware that was discovered in 2010. It is studied because it brought several ideas in this lesson together in one real case. MITRE describes it as the first publicly reported malware to specifically target industrial control system devices.
- Industrial control systems. It targeted Siemens industrial software, including the STEP 7 software used to program controllers, and Siemens PLCs.
- A cyberattack with physical-world effects. It is widely reported to have been directed at uranium-enrichment equipment in Iran and to have caused physical damage by changing how the controllers drove machinery.
- The connection between IT and OT. It reached industrial controllers by first infecting ordinary Windows computers, including those used to program the controllers.
- Removable media as a vector. It could spread on infected USB drives, which is one way malware can reach systems that are not connected to the internet.
- Exploitation of software vulnerabilities. It used several previously unknown Windows vulnerabilities.
- A highly targeted and sophisticated operation. It was built to act only on a specific industrial configuration.
Check your understanding
Show the answer
Answer: B. Infected USB drives.
Infected USB drives: removable media can carry malware to systems with no internet connection.
Who built Stuxnet has never been officially confirmed, so this lesson does not attribute it. The lesson to keep is the combination: attack surface (USB ports, Windows computers, engineering software), vector (removable media, then spread between machines) and OT risk (a physical process altered by software).
Stage: Predict
Reducing the attack surface
Think it through
An organisation cannot shrink its attack surface to nothing. What kinds of action could still make it smaller and safer?
- Hint 1: What could simply be switched off or removed?
- Hint 2: For what must stay, how could you limit who reaches it?
Show what happens
Get rid of what is not needed, restrict what is needed, and keep patching and watching what is left. The memory aid below sorts the measures into those three groups.
The surface cannot be reduced to nothing: an organisation has to have staff, a website and suppliers. It can be made much smaller and much better protected. A memory aid sorts the practical measures into three groups:
Remove what you do not need, restrict what you do need, and patch and monitor what remains.
Remove what you do not need.
- Disable unused services and close unnecessary ports.
- Remove unused accounts and unnecessary software.
- Replace systems the manufacturer no longer supports.
- Reduce Shadow IT by offering approved alternatives that are easy to use.
Restrict what you do need.
- Use MFA and apply least privilege.
- Segment the network.
- Secure the access given to third parties.
- Harden internet-facing systems: switch off the features they do not need and change their default settings.
- Control removable media, such as USB sticks, and use physical access controls.
Patch and monitor what remains.
- Patch promptly.
- Run vulnerability scanning.
- Monitor the assets that are exposed.
A useful first exercise for any system is to write two lists. The first is everything that can reach it: people, networks, other systems and suppliers. The second is which of those it actually needs. Everything on the first list and not the second is attack surface that could be removed.
Stage: Explain
Security+ terminology
The CompTIA Security+ SY0-701 exam objectives (objective 2.2) use the phrase threat vectors and attack surfaces. The vectors they list include message-based (email, SMS and instant messaging), image-based, file-based, voice call, removable device, vulnerable software, unsupported systems and applications, unsecure networks (wireless, wired and Bluetooth), open service ports, default credentials, and the supply chain (managed service providers, vendors and suppliers).
The objectives use vector broadly. The same list holds channels (email, SMS, voice call), delivery forms (files, images, removable devices), weaknesses (default credentials, unsupported systems) and, under human vectors/social engineering, techniques such as phishing and pretexting. Expect the word at any of the levels described in Message-based vectors, and read a question for the level it is asking about.
One piece of wording needs care. Under vulnerable software the objectives say “client-based vs. agentless”. Read “client-based” there as software installed on the device, which the industry more often calls an agent. Study materials differ on what the phrase contrasts. Some, like this lesson, treat it as two ways of deploying vulnerability scanning. Others treat it as two kinds of vulnerable software: an application installed on the device, against a service used without installing anything, such as a web application. In both readings the dividing line is the same: is there software installed on the endpoint, or not?
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Think beyond the school’s own staff and equipment: who else can reach its systems?
Show the answer
Answer: B. Suppliers with access, such as IT support.
Suppliers with access to school systems are part of the attack surface, and so are people, remote access, buildings and cloud services.
Apply it
Show the answer
Answer: A. No: it does not stand in for that patch.
No. To compensate, a control must stand in for the patch on that computer, for example by isolating it and watching it closely.
Stage: Check
Check your understanding
These questions come from the approved revision bank. They were approved under the site’s approval workflow, which includes owner-authorised delegated review: not every question was read individually by the site owner.
Surfaces and vectors
Show answer
Answer: The surface is every point that could be attacked; a vector is the route actually used
The attack surface is the total set of points where an attacker could interact with or try to compromise an organisation, system or application, and an attack vector is the route or method actually used. One is a set of places and the other is a path through one of them. Motive and identity are different questions, and neither term is limited to hardware or to software.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: The VPN portal; The public website; Staff email accounts
The attack surface is the points where an attacker could interact with or try to compromise the organisation, and a vector is the route or method actually used. The VPN portal, the public website and staff email accounts are all points that could be reached, so they are parts of the surface. A phishing email and the use of stolen credentials are methods of getting in through those points, so they are vectors.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: The outdated, flawed service
A vector, which is a route, is separate from a weakness, which is what makes the route exploitable. Here the route is network access to the open port, and the weakness is the outdated, flawed service listening on it. Keeping them apart shows two possible responses: close the route by removing the service or blocking the port, or fix the weakness by updating the software. The internet connection and the attacker’s interest are neither.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: Disabling services that are not used; Removing accounts that are no longer needed; Closing ports that are not required
The rule is to remove what is not needed, restrict what is needed, and patch and monitor what remains. Disabling unused services, removing unneeded accounts and closing unnecessary ports all remove points an attacker could reach. Opening another public service adds a new point to the surface, and giving everyone administrator rights widens what a single compromised account can do, so both increase exposure.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: True
True. An attack surface is relative to what is being assessed. The scope can be an organisation, with every site, system, person and supplier; a single system, with its services, accounts and connections; or one application, with its sign-in page, forms and interfaces. That is why it helps to say what is being measured before describing its attack surface.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: The communication channel, such as email or SMS
Message-based vectors include email, SMS, instant messaging, web and social media, and voice calls. The communication channel is the vector, because it is the route by which the attack reaches a person. The malicious link, attachment or request is the content carried over that channel. The password is what the attacker wants, and the recipient is part of the attack surface.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: A supply-chain attack
A supply-chain attack reaches the target through a trusted supplier, vendor or dependency. Here the trusted relationship, the provider’s remote-support connection, is abused as the route into each customer. A watering-hole attack compromises a website the targets visit, pharming redirects users to a fraudulent destination, and typosquatting relies on a lookalike domain name. None of those involves a supplier’s trusted access.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: False
False. An incident at a supplier is a supply-chain attack on its customer only when the trusted relationship is abused as the route in. If the supplier’s own records are stolen and nothing reaches the customer through the relationship, it is an incident at the supplier. It would become a supply-chain attack if, for example, the supplier’s software update or remote-support access were used to get into the customer.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: Malware can reach control systems by removable media and cause physical effects
Stuxnet is an example of a sophisticated attack against industrial systems. It targeted Siemens industrial control software and programmable logic controllers, could spread by removable media and exploited software vulnerabilities. It shows that an attack on operational technology can have physical effects, and that a system without an internet connection still has an attack surface.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Vulnerable software and scanning
Show answer
Answer: A small software component installed on each device reports what it finds
Vulnerability scanning can be deployed in two ways: with software installed on the endpoint, or agentless. Agent-based scanning installs a small software component, an agent, on each endpoint, which reports from the inside and gives deeper local visibility. A central scanner connecting remotely with nothing installed is the agentless approach. Manual inspection and supplier visits are not what either term means.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: Agent-based, because the agent reports whenever the laptop is online
Agent-based scanning covers devices that are only intermittently connected, because the agent runs on the device itself and reports when it can. An agentless scanner has to reach the laptop over the network at the moment of the scan, so a laptop that is travelling is missed. A device that is switched off cannot be scanned remotely. The trade-off is that the agents have to be deployed and maintained.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: Network reachability and the credentials the scanner is given
Agentless scanning installs no dedicated agent and examines the target remotely through existing mechanisms such as SSH, WinRM or WMI, SNMP or an API. It is easier to deploy centrally, but it can only assess what it can reach over the network and sign in to. A device that is off the network at scan time, or for which the scanner has no working credentials, is seen poorly or not at all.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: Segmenting it from the network, restricting access to it and monitoring it closely
Compensating controls for a legacy server that cannot be patched include network segmentation, firewall restrictions, least privilege, restricted access, and monitoring and logging. They do not fix the weakness; they make it harder to reach and misuse easier to notice. An exemption with no action leaves the gap open, a second copy doubles it, and email passwords are unrelated to the server.
Revision sources: Session 8: Threat Actors, Attack Surfaces and Social Engineering (Classroom session record) · Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: False
False. An agent is a small background component that monitors or manages a device, whereas a thick client is a full locally installed application that does substantial processing on the computer, such as a desktop accounting package. Both are installed on the device, which is why they are confused, but they exist for different purposes and are very different in size and function.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Show answer
Answer: Its vendor no longer provides security fixes for it
An unsupported system no longer receives security fixes from its vendor. A weakness discovered after support ended stays open, however long the system keeps running, so working is not the same as safe. Where such a system cannot be patched or replaced, compensating controls are used. Warranty, network capability and whether the software still runs are separate matters.
Revision sources: Attack Surfaces and Attack Vectors (Supplementary Study Guide explanation)
Study and revision
Practise through the Threat Actors & Attack Vectors topic and the Vulnerabilities topic. Questions cover the difference between a surface and a vector, a vector and a weakness, message-based vectors, supply-chain attacks, Stuxnet, reducing the attack surface, agent-based and agentless scanning, unsupported systems and compensating controls; five flashcards recall the surface and vector distinction, the three-part rule for reducing a surface, what makes an incident a supply-chain attack, the two scanning approaches and compensating controls for a legacy server. Items that use this lesson’s supplementary explanation say so. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objective 2.2 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- The attack surface is everything that could be tried; the attack vector is the route used. Say what you are assessing first.
- A route becomes dangerous through a weakness, so close the route, fix the weakness, or both.
- Systems that cannot be patched need compensating controls that make the weakness harder to reach and misuse easier to see.
- Agent-based scanning reports from inside a device; agentless scanning sees only what it can reach.
- Suppliers extend the surface; remove what you do not need, restrict what you do, and patch and monitor the rest.
Key terms
- Attack surface
Every point where an attacker could interact with, or try to get into, an organisation, system or application.
- Attack vector
The route or method an attacker uses to reach a target, such as a phishing email, stolen remote-access credentials or an infected removable drive.
- Supply-chain attack
An attack that reaches its target through a supplier, service or software component the target trusts.
- Compensating control
An alternative safeguard used when the preferred control cannot be implemented, reaching a similar security objective another way.
- Agent-based scanning
Vulnerability scanning in which a small software component, an agent, is installed on each device and reports what it finds.
- Agentless scanning
Vulnerability scanning that installs no dedicated agent on the target and instead examines it remotely, using existing mechanisms such as SSH, WMI or an API.
Common misunderstandings
The surface is every point that could be attacked. A vector is the one route used. An organisation has one surface and faces many vectors.
Removable media, staff, suppliers and physical access all remain. Stuxnet reached systems that were not directly connected.
Working is not the same as safe. Without vendor fixes, every newly found weakness stays open, so the system needs replacing or compensating controls.
It sees what it can reach over the network and sign in to. Devices that are off the network at scan time are missed.
Further reading
- MITRE ATT&CK: Stuxnet (S0603): what Stuxnet did, technique by technique.
- CISA: Primary Stuxnet Advisory (ICSA-10-272-01): the industrial control systems advisory.
- NCSC: Supply chain security guidance: twelve principles for gaining control of a supply chain.
- CompTIA Security+ SY0-701 exam objectives (PDF): objective 2.2 lists the threat vectors and attack surfaces quoted in the Security+ terminology step.
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 8 (see the Session 8 Learning Log): attack surfaces and attack vectors, with a fictional water and power company used to ask how an attacker could get in; vulnerable software vectors, compensating controls and two ways of deploying vulnerability scanning; network vectors; Stuxnet, shown in a video; message-based vectors; and the supply-chain attack surface.
- Accuracy qualifications: “agent-based” is used here as the usual industry term for what the session material called client-based; a vector is kept separate from the weakness that makes it exploitable; “vector” is used for the channel, for what a message carries and for the social-engineering technique, and the channel shortcut does not make the other uses wrong; and not every incident at a third party is a supply-chain attack.
- Independently checked: the Stuxnet details against MITRE ATT&CK’s software page and the CISA industrial control systems advisory, and the Security+ wording against the published SY0-701 objectives. These are external references, not course evidence.
- Supplementary explanation: the burglar comparison, the definitions and memory aids, the diagram of the utility’s attack surface and the points and vectors placed in it, the explanation of IT, OT, ICS, SCADA, PLCs and engineering workstations, the vector and weakness table, the description of each software weakness, the legacy-server example, the advantages and trade-offs of each scanning approach, the comparison with a thick client, the grouping of network vectors, the channel table, the supply-chain diagram and examples, the professional statement of “denying opportunity”, the measures for reducing the attack surface, the practical exercise, the grouping of the reduction measures under remove, restrict, and patch and monitor, the Security+ terminology note and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagrams are original.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the house opening questions, every question asked in the lesson with its feedback and hints, the VPN, unsupported-server, sales-laptop, router, tampered-update, school and leisure-centre examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The water and power company is fictional. I watched a video about Stuxnet; I have not mapped a real organisation’s attack surface, run a vulnerability scan or worked on an industrial control system.
Recording what an identity did on a system, such as signing in, opening files, making changes and being refused.
Vulnerability scanning in which a small software component, an agent, is installed on each device and reports what it finds.
Vulnerability scanning that installs no dedicated agent on the target and instead examines it remotely, using existing mechanisms such as SSH, WMI or an API.
Something an organisation values, such as information, a service, equipment or a business capability.
Evidence that gives confidence that security requirements are met or controls are working, within a defined scope and time.
Every point where an attacker could interact with, or try to get into, an organisation, system or application.
The route or method an attacker uses to reach a target, such as a phishing email, stolen remote-access credentials or an infected removable drive.
An alternative safeguard used when the preferred control cannot be implemented, reaching a similar security objective another way.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
A device at the end of a network connection that people or programs actually use: a laptop, desktop computer, phone, tablet or server.
How far a system, service or piece of information can be seen or reached by others, especially from the internet.
A control that allows or blocks network traffic according to configured rules.
A system that monitors or controls an industrial process, such as water treatment, power distribution or manufacturing.
Granting users, processes and systems only the access necessary to perform their authorised functions.
Malicious software designed to disrupt, damage or gain unauthorised access to devices, networks or data. Ransomware is one type.
Authentication that requires two or more different types of factor, such as something you know and something you have.
A program or function that can be reached over the network, listening for and responding to requests on an address and port.
Systems that monitor or control physical equipment and processes, such as in manufacturing, transport or utilities.
Applying updates from a software vendor that fix known vulnerabilities or other flaws.
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
A rugged industrial computer that directly controls machinery, such as pumps, valves or motors, by following programmed logic.
Inventing a believable story or scenario that gives the target a reason to comply with a request.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
A device that forwards traffic between networks, for example between a private local network and the internet.
Systems that let operators monitor and control industrial equipment spread across a site or a region from a central point.
The unit of data TCP creates at the Transport layer, carrying source and destination port numbers. The Network layer then places it in a packet.
Dividing an environment into parts, with enforced rules about which communication is allowed between them.
Technology, applications or services used for work without the organisation’s approval or management.
Phishing carried out by SMS text message.
A software endpoint for network communication, managed by the operating system.
An attack that reaches its target through a supplier, service or software component the target trusts.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
Risk an organisation inherits through its suppliers, service providers and the software or services it depends on.
Phishing carried out by voice call.
A protected connection across a network that is not trusted, usually the internet. Organisations use one to let a computer outside the building reach the internal network as if it were inside.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.