Attack Surface Reduction

Attack Surface Reduction is the first principle of designing secured architectures. The best protection against attacks from aggresive Internet is to close any ability for malicious users to attack the system or services (access to admin part, SSH, FTP, RDP, etc.)

Usually this priniciple began to use when something wrong already happened. Although it may and must be defined during architecture design phase or at last at first deployment.

Firewall is the first tool for attack surface reduction. Most of technical staff forget about it. And even if remember, firewalls usually configured to filter only INPUT traffic. Only small amount of system filters OUTPUT traffic as well although it is also important to control what external resources does the server use to interchange data. If OUTPUT traffic is not filtering, attacker just need to find a way to perform malicous code on the server (SQL Injection, Shell Injection or infect the machine in advance) and pull data from the server to any location. Just recently we participated in investigation of the incident when the system was infected by fired admin and send periodically data from business system to suspicious address in Internet.

There is typical architecture on the right left picture: web site, admin part to web site (/admin), database. 3 groups of users: anonymous and registered users, managers, techinical support. Definitely you will have much complex architecture, but this example will give understanding how to protect the system.