An attack surface is the collection of exposed interfaces, components, and entry points through which an attacker may affect a system. For APIs, it includes public resources, older versions, internal endpoints, connected devices, and supporting infrastructure. section 1.6 section 5.0
A larger or poorly modeled attack surface gives threat actors more opportunities to bypass business checks, obtain sensitive information, hijack devices, or abuse system functionality. Connecting devices to APIs can expose homes, stores, vehicles, and private networks. section 1.6
A forgotten endpoint
An organization may protect its current API while leaving an older version or internal endpoint less protected. An attacker searches those entry points and uses the weaker path to trigger requests or reach sensitive information. Similar failures occur when a mortgage API allows applicants to skip sequential risk checks or when a laundry-service API permits free use. section 1.6 section 5.0
Reduce the attack surface by:
- Inventorying APIs, versions, endpoints, devices, and infrastructure. section 9.0
- Restricting direct exposure with bastion servers, a demilitarized zone, and controls that prevent lateral movement. section 9.0
- Using API gateways and WAFs for consistent access controls, secure configuration, visibility, and monitoring, while recognizing their limitations. section 9.0
