The sum of all points where an unauthorized user could try to enter or extract data from a system.
Reducing attack surface — closing unused ports, removing unnecessary services, limiting exposed endpoints — is one of the most effective, if unglamorous, security practices available.
