# Attack Surface Reduction

> A design rule that endpoints, ports, features and permissions nothing uses are removed or disabled.

Record: `architecture:attack-surface-reduction`
Kind: principle
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: API, service, infrastructure
Canonical: https://banes-lab.com/ontology#architecture-attack-surface-reduction

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [Secure by Default](https://banes-lab.com/records/architecture/secure-by-default.md) and before [Threat Modeling](https://banes-lab.com/records/architecture/threat-modeling.md).

## Repair

- Refactored by: Remove Endpoint, Restrict Access, Disable Feature
- Detected by: exposed unused routes/services
- Violated by: unused open ports/endpoints/permissions
- Measured by: exposed surface count
- Enforced by: attack surface scanning

## Requires

- [Minimal Exposure](https://banes-lab.com/records/lexicon/minimal-exposure.md)

## Reinforces

- [Security by Design](https://banes-lab.com/records/architecture/security-by-design.md)

## Enables

- [Reduced Exploitability](https://banes-lab.com/records/lexicon/reduced-exploitability.md)

## Conflicts with

- [Unnecessary Public Surface](https://banes-lab.com/records/lexicon/unnecessary-public-surface.md)

## In tension with

- [Feature Exposure](https://banes-lab.com/records/lexicon/feature-exposure.md)

## Tensions

- [Attack Surface Reduction / Feature Exposure](https://banes-lab.com/records/tension/attack-surface-reduction-feature-exposure.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Linked from

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)