Threats & Attacks

Req 4f — Attack Surface

4f.
Create a list of what is part of your cyber attack surface including all the ways someone could try to access your personal information or devices—such as online accounts, apps, or home networks.

Your attack surface is every possible point where an attacker could try to get into your digital life. Think of it as all the doors, windows, and vents in a building — the more entry points, the harder the building is to secure. Most people have a much larger attack surface than they realize.

What Makes Up Your Attack Surface?

Your attack surface includes everything that connects you to the digital world. Let’s walk through the major categories.

Devices

Every device you own or use regularly is part of your attack surface:

Each device has its own operating system, its own apps, its own vulnerabilities. An attacker who compromises any one of them gains a foothold into your digital life.

Online Accounts

Think about every account you have ever created — and be honest, because the number is probably higher than you think:

Each account is a potential target. If any two share the same password, compromising one compromises both.

Apps and Software

Every app installed on your devices is part of your attack surface:

Home Network

Your home network is its own attack surface:

Personal Information Already Online

Some parts of your attack surface already exist whether you want them to or not:

Creating Your List

Here is how to systematically map your attack surface:

Attack Surface Inventory

Go through each category and list everything
  • Devices: List every device you use regularly, including shared family devices.
  • Accounts: Open your email and search for “welcome” or “verify your email” to find accounts you may have forgotten.
  • Apps: Go through your phone and computer app lists. Include browser extensions.
  • Home network: List your router and every smart or connected device in your home.
  • Shared access: Note any accounts where you share passwords with friends or family.
  • Old accounts: Include accounts you no longer use but never deleted — these are often the most vulnerable.

What Your List Tells You

Once you see your full attack surface, you will likely be surprised by its size. The goal is not to eliminate everything — you cannot live without digital tools. The goal is to reduce your attack surface where possible and strengthen the parts you keep.

Quick Wins to Shrink Your Attack Surface

Connected Devices — Keys to Cybersecurity A lesson module from Cyber.org about managing the security of your connected devices.
Infographic showing a teenager with radiating connections to their digital attack surface: devices, accounts, and networks