ATTACK SURFACE ANALYSIS: Reduce System and Organizational Risk

Much effort is expended implementing security controls and practices to address mandated policy. How-ever, operational experience is showing that these steps are necessary, but not sufficient. The mantra to think like an attacker has been widely bandied by experts and contractors in the field. For those who struggle daily to make technology perform as needed, this advice poses a major challenge. Attacker capabilities are increasing continually. How should one determine and address possible system attacks?