Glossary: Secure Infrastructure and Zero Trust

attack surface

Also written: external attack surface, internal attack surface

Every point where an attacker could try to get in or cause harm: open ports, services, accounts, remote access paths and devices. The external side is what the internet can reach, and the internal side is what someone already inside can reach.