Count your lab's attack surface honestly

short · 45 min · Objective 1.9

Task

Enumerate every category of attack surface in your lab, not just listening ports, and discover which category is largest.

Steps

  1. Create lab/surface.csv with header category,item,exposure,authenticated,owner.
  2. Enumerate at least five categories: network interfaces, application endpoints, identities, dependencies, and external integrations. Include every service account, key and token as a separate row.
  3. Set exposure to internet, internal or restricted, and authenticated to yes or no for each.
  4. Count per category and record the totals in lab/surface-count.md, with the largest category named explicitly.
  5. Reduce the surface by at least three items -- delete an unused identity, remove a dependency, close an endpoint -- and record the before and after totals.

Verify

awk -F, 'NR>1 {print $1}' lab/surface.csv | sort | uniq -c | sort -rn
awk -F, 'NR>1 {n++} END {print n" surface item(s)"}' lab/surface.csv
awk -F, 'NR>1 && $3=="internet" && $4=="no" {n++} END {print n+0" unauthenticated and internet-facing"}' lab/surface.csv
grep -Ec '[0-9]+' lab/surface-count.md

Five or more categories, and before/after totals recorded. In most labs the identity category is the largest, and if yours is not, you have not enumerated service accounts, keys and tokens as separate items.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.