Attack Surfaces and Attack Vectors

Lesson plan

Level

Beginner

Time

About 90 minutes; the steps below add up to 92

Learners list every way into a house and then see that the one route used on the night is not the whole exposure, which separates attack surface from attack vector before either is named. They then map a water and power company before seeing the diagram, and predict whether a reachable VPN is dangerous on its own, what to do with a server that cannot be patched, what the vector of a phishing email is at each level, and whether a tampered update defeats a company’s defences. The habit to build: list everything that could be tried, then separate each route from the weakness that makes it usable.

Objectives

• Tell an attack surface (everything that could be tried) from an attack vector (the route used)
• Map the attack surface of an organisation area by area, including where IT meets operational technology
• Separate a route from the weakness that makes it usable
• Describe software, network, message-based and supply-chain vectors, and compensating controls for systems that cannot be patched
• Choose between agent-based and agentless scanning, and reduce an attack surface

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Threat Actor Types and Vulnerabilities and Exposure lessons first.
• This is a long lesson: consider teaching it over two sessions, breaking after the network vectors step.
• The lesson takes about 92 minutes. To teach it in two parts, stop after “Message-based vectors”; the second part opens with “The supply chain as an attack surface”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Tell an attack surface (everything that could be tried) from an attack vector (the route used)
   • Map the attack surface of an organisation area by area, including where IT meets operational technology
   • Separate a route from the weakness that makes it usable
   • Describe software, network, message-based and supply-chain vectors, and compensating controls for systems that cannot be patched
   • Choose between agent-based and agentless scanning, and reduce an attack surface

   Purpose: Learners list every way into a house and then see that the one route used on the night is not the whole exposure, which separates attack surface from attack vector before either is named. They then map a water and power company before seeing the diagram, and predict whether a reachable VPN is dangerous on its own, what to do with a server that cannot be patched, what the vector of a phishing email is at each level, and whether a tampered update defeats a company’s defences. The habit to build: list everything that could be tried, then separate each route from the weakness that makes it usable.

2. 1. Every way in Think 6 min

   Purpose: Separate everything that could be tried from the route actually used, before any term.

   Ask

   • List every way into the house.
   • Is the side gate the whole of the exposure?

   Responses to expect

   • Lists grow quickly; push for a person (a delivery driver) as a way in.
   • Some say yes once the gate is mended; ask about tomorrow night.
   • On screen in turns: the opening question, its answer; then the question on the side gate, and its answer.

   Discussion pause: Build the class list on the board before revealing anything.

   In the lesson window

   • Think it through: Look at a house as a burglar would. List every place where an entry could be attempted.
   • Think it through: On the night, the burglar gets in through the side gate. Is the side gate the whole of the house’s exposure?

3. 2. Surface and vector Explain 7 min

   Purpose: Name attack surface and attack vector, and show that the surface depends on what is assessed.

   Ask

   • Is the attack surface of one application the same as that of the whole organisation?

   Responses to expect

   • No: say what you are assessing first.
   • On screen in turns: the opening; then a memory aid for the two terms; an example for one organisation; surface and vector side by side; the attack vector; why the surface depends on what you assess.

   If the explanation does not land: A football pitch: the whole goal is the surface a striker could aim at; the one shot actually taken is the vector.

4. 3. Mapping an attack surface: a water and power company Experiment 10 min

   Purpose: Map an organisation area by area, and show where IT meets operational technology.

   Ask

   • Name four areas where an attacker might try to get in.
   • Why is the engineering workstation such an important point?

   Responses to expect

   • Suppliers and cloud services are the areas most often missed.
   • It is an ordinary computer that can change how physical equipment behaves.
   • On screen in turns: the opening question, its answer; then the map of the company’s attack surface; a fuller list for such a company; where IT meets operational technology.

   To go further

   • Draw the same six-area map for your own school, college or workplace.

   In the lesson window

   • Think it through: Before you look at the map: name at least four different areas of a water and power company where an attacker might try to get in.

5. 4. A vector is a route and a weakness makes it usable Predict 5 min

   Purpose: Separate the route from the weakness along it, and the two kinds of fix.

   Ask

   • Is a reachable VPN dangerous on its own?

   Responses to expect

   • Some say yes; ask what an attacker would need to use it.
   • On screen in turns: the opening question, its answer; then why a route on its own harms nobody; routes and the weaknesses that make them usable, with the weaknesses held back; the weakness along each route; closing the route or fixing the weakness.

   Discussion pause: The weakness column is held back: ask what would make each route usable before revealing it.

   In the lesson window

   • Think it through: A company’s VPN can be reached from the internet, because staff work from home. Is that, on its own, dangerous?

6. 5. Vulnerable software vectors Predict 12 min

   Purpose: Show where software weaknesses come from, compensating controls for unpatchable systems, and the two kinds of vulnerability scanning.

   Ask

   • If you cannot patch the server, what else could you do?
   • The travelling laptop: which scanning approach?

   Responses to expect

   • Learners usually reach isolation and monitoring; push for least privilege too.
   • Agentless is a common first answer because it sounds simpler.
   • On screen in turns: the opening; then where software weaknesses come from; the question on a server that cannot be patched, and its answer; the preferred control, and what a compensating control is; the legacy server, with its compensating controls; why a compensating control must stand in for a specific one; agent-based scanning; agentless scanning; agent-based and agentless side by side; the check question on the travelling laptop, and its answer; why an agent is not a thick client.

   Misconceptions to challenge

   • A learner may believe: “A compensating control is any extra security.” Respond: It must stand in for a specific control that cannot be used.

   In the lesson window

   • Think it through: A server runs software its maker no longer supports, and it cannot be replaced this year. If you cannot patch it, what else could you do?
   • Check your understanding: A sales manager’s laptop is mostly used away from the office and is often off the company network. Which scanning approach would see it more reliably?

7. 6. Network vectors Check 5 min

   Purpose: List network routes and pick out which items are weaknesses.

   Ask

   • Which of the three is a weakness, not a route?

   Responses to expect

   • Most spot the default password quickly.
   • On screen in turns: the opening; then the kinds of network route; routes and weaknesses mixed in the list; the check question on a weakness, not a route, and its answer.

   Misconceptions to challenge

   • A learner may believe: “Everything in the list is a way in.” Respond: The list mixes routes (remote access, Wi-Fi) with weaknesses that make them usable (default credentials). Sort them before deciding what to change.

   In the lesson window

   • Check your understanding: Which of these is a weakness rather than a route?

8. 7. Message-based vectors Predict 7 min

   Purpose: Show the levels at which “vector” is used for a message-based attack, and the phishing names by channel.

   Ask

   • The email, the link or the deception: which was the vector?

   Responses to expect

   • Learners often argue for one; the point is that each is right at its own level.
   • On screen in turns: the opening question, its answer; then three levels at which vector is used, starting with the channel; the delivery mechanism; the social-engineering technique; the shortcut that keeps the levels apart; channels and the names for phishing over them, with the names held back; the name used for each channel.

   Discussion pause: The names for phishing over each channel are held back: let the class name them first.

   In the lesson window

   • Think it through: A phishing email contains a link to a fake sign-in page. What was the vector: the email, the link, or the deception?

9. 8. The supply chain as an attack surface Predict 8 min

   Purpose: Show how suppliers extend the surface, and what makes an incident a supply-chain attack.

   Ask

   • Did the tampered update defeat the company’s defences?

   Responses to expect

   • Many say yes; ask whether anything was broken through.
   • Diagram: step through the four links of a supply-chain attack and ask, at each, what the target could have checked.
   • On screen in turns: the opening; then what the supply-chain surface includes; the question on the tampered update, and its answer; what a supply-chain attack is; how a supply-chain attack reaches its target, one link at a time; the diagram’s stages one at a time; examples of the trusted route being abused; why not every supplier incident is a supply-chain attack; denying opportunity.

   Misconceptions to challenge

   • A learner may believe: “Any incident at a supplier is a supply-chain attack.” Respond: Only when the trusted relationship carries the compromise to the customer.

   In the lesson window

   • Think it through: A well-defended company installs a software update from a trusted supplier. Attackers had tampered with the update, and it lets them in. Did they defeat the company’s defences?

10. 9. A real example: Stuxnet Explain 6 min

    Purpose: Use a published case to connect surface, vector, IT and OT, without attributing it.

    Ask

    • Which part of the story was the vector into offline systems?

    Responses to expect

    • USB drives, found or handed out.
    • On screen in turns: the opening; then what Stuxnet brought together, starting with industrial control systems; physical-world effects; the connection between IT and OT; removable media as a vector; software vulnerabilities; a highly targeted operation; the check question on Stuxnet’s vector, and its answer; attribution, and the lesson to keep.

    If the explanation does not land: Trace Stuxnet’s path on the water-company map: physical (USB), then Windows computers, then PLCs.

    In the lesson window

    • Check your understanding: In Stuxnet’s story, which was the vector into systems that were not connected to the internet?

11. 10. Reducing the attack surface Predict 6 min

    Purpose: Sort the measures into remove, restrict, and patch and monitor.

    Ask

    • What could make the surface smaller and safer?

    Responses to expect

    • “Remove” is the group learners most often leave out.
    • On screen in turns: the opening question, its answer; then the memory aid: remove, restrict, patch and monitor; remove what you do not need; restrict what you do need; patch and monitor what remains; a first exercise for any system.

    If the explanation does not land: Clearing out a house before going on holiday: get rid of what you do not need, lock what you keep, and ask a neighbour to keep an eye on the rest.

    In the lesson window

    • Think it through: An organisation cannot shrink its attack surface to nothing. What kinds of action could still make it smaller and safer?

12. 11. Security+ terminology Explain 3 min

    Purpose: Map the lesson to the Security+ objectives’ wording, including “client-based”.

    Ask

    • What does “client-based” mean in the objectives’ scanning wording?

    Responses to expect

    • Software installed on the device: what the industry usually calls an agent.
    • On screen in turns: the opening; then how the objectives use vector; client-based versus agentless.

13. 12. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The school list tests suppliers as part of the surface; the leisure centre tests compensating controls.
    • On screen in turns: the opening question, its answer; then the question on a second firewall, and its answer.

    In the lesson window

    • Apply it: A school writes down its attack surface: the website, staff email and the Wi-Fi. Which important area is missing?
    • Apply it: An old door-controller computer at a leisure centre cannot be patched. A manager proposes buying a second firewall for head office instead. Is that a compensating control for the computer?

14. 13. Check your understanding Check 10 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • Several questions are multiple-select.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; the next group of revision questions, starting with its first; the second revision question; the third revision question; the fourth revision question; the fifth revision question; the sixth revision question; where to practise next.

15. 14. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: what is the difference between a surface and a vector?

    Responses to expect

    • Everything that could be tried, against the route actually used.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

16. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Everything that could be tried, and the one route actually used, are two different ideas.
    • Fix the route, the weakness along it, or both.
    • When a patch is impossible, make the weakness hard to reach and easy to watch.
    • An agent reports from inside; an agentless scanner sees only what it can reach.
    • Suppliers widen the surface; remove, restrict, then patch and monitor.

Consolidation

• Everything that could be tried, and the one route actually used, are two different ideas.
• Fix the route, the weakness along it, or both.
• When a patch is impossible, make the weakness hard to reach and easy to watch.
• An agent reports from inside; an agentless scanner sees only what it can reach.
• Suppliers widen the surface; remove, restrict, then patch and monitor.