<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-attack-surface-threat-modeling
description: >-
  Map and score application attack surfaces for threat modeling prioritization.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - attack-surface
  - entry-points
  - trust-boundaries
  - exposure-analysis
  - asset-inventory
  - risk-prioritization
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T1190"
  - "T1133"
  - "T1566"
---

# Performing Attack Surface Threat Modeling

## Overview

Attack surface analysis systematically identifies all points where an adversary can interact with
a system — network endpoints, APIs, UI inputs, file uploads, third-party integrations, and
administrative interfaces. Reducing and monitoring the attack surface is a foundational step
before applying STRIDE or other threat categorization frameworks.

Mode: `[MODE: ARCHITECT]` — Attack surface enumeration and risk-ranked reduction.

## Prerequisites

- Network architecture diagrams and asset inventory
- `nmap` for network surface scanning: `apt install nmap`
- `httpx` for HTTP endpoint probing: `pip install httpx`
- Python 3.10+

## Key Concepts

### Attack Surface Categories

| Category | Examples | Risk Factors |
|----------|----------|-------------|
| **Network** | Open ports, listening services, VPN endpoints | Internet-facing, unpatched services |
| **Application** | Web forms, API endpoints, file uploads | Input validation gaps, auth bypasses |
| **Human** | Phishing targets, help desk, social media | Privilege level, security awareness |
| **Physical** | USB ports, console access, badge readers | Facility access controls |
| **Supply Chain** | Third-party libs, SaaS integrations, CI/CD | Dependency trust, update mechanisms |

### Attack Surface Metrics

- **Entry Point Count** — total interaction points exposed
- **Trust Boundary Crossings** — data flows crossing privilege boundaries
- **Authentication Coverage** — percentage of endpoints requiring auth
- **Exposure Score** — weighted risk across all surface categories

## Workflow

### Step 1: Inventory Entry Points

```bash
# Scan network attack surface
nmap -sV -sC -oX scan.xml target-range

# Enumerate HTTP endpoints from OpenAPI spec
node scripts/agent.js --action enumerate --input openapi.json
```

### Step 2: Classify and Score

```bash
# Classify entry points by risk
node scripts/agent.js --action classify --input entry_points.json

# Score attack surface
node scripts/agent.js --action score --input classified.json --output scored.json
```

### Step 3: Generate Reduction Report

```bash
node scripts/agent.js --action report --input scored.json --output report.json
```

## Verification

- [ ] All network-facing services inventoried with ports and protocols
- [ ] API endpoints catalogued from OpenAPI/Swagger specs
- [ ] Trust boundaries identified at every privilege transition
- [ ] Each entry point scored for exposure risk
- [ ] Reduction recommendations prioritized by risk-to-effort ratio
- [ ] Attack surface baseline documented for change tracking

## References

- [OWASP Attack Surface Analysis Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.html)
- [Microsoft Threat Modeling — Attack Surface](https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool)
- [CIS Controls v8 — Control 16: Application Software Security](https://www.cisecurity.org/controls)
- [NIST SP 800-53 — CM-7: Least Functionality](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
