# Attack Surface Reduction

Record: `arch:attack-surface-reduction`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: API, service, infrastructure
Canonical: https://banes-lab.com/ontology#arch-attack-surface-reduction

## Repair

- Refactored by: Remove Endpoint, Restrict Access, Disable Feature
- Detected by: exposed unused routes/services
- Violated by: unused open ports/endpoints/permissions
- Measured by: exposed surface count
- Enforced by: attack surface scanning

## requires

- [Minimal Exposure](https://banes-lab.com/records/lex/minimal-exposure.md)

## reinforces

- [Security by Design](https://banes-lab.com/records/arch/security-by-design.md)

## enables

- [Reduced Exploitability](https://banes-lab.com/records/lex/reduced-exploitability.md)

## conflicts-with

- [Unnecessary Public Surface](https://banes-lab.com/records/lex/unnecessary-public-surface.md)

## tensions-with

- [Feature Exposure](https://banes-lab.com/records/lex/feature-exposure.md)

## tensions

- [Attack Surface Reduction Feature Exposure](https://banes-lab.com/records/tension/attack-surface-reduction-feature-exposure.md)