This article is rated C-class on Wikipedia's content assessment scale. It is of interest to the following WikiProjects:

Computer security: Computing Mid‑importance This article is within the scope of WikiProject Computer security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Computer securityWikipedia:WikiProject Computer securityTemplate:WikiProject Computer securityComputer security Mid This article has been rated as Mid-importance on the project's importance scale. This article is supported by WikiProject Computing (assessed as Low-importance). Things you can help WikiProject Computer security with: How you can help: Add to your watchlist the project talk page! Post there for help with articles or to suggest articles that need work. Request editing suggestions on your talk page by entering WikiProject_Computer_security into this template. Check the article alerts to participate in deletion discussions, review Good Article nominees, and review draft articles. Edit any articles that interest you. Recommended: Most popular articles that need the most work (last refreshed 1 August 2026) Popular articles (monthly top articles by views) High-importance stub-quality articles High-importance start-quality articles Mid-importance stub-quality articles Mid-importance start-quality articles Unknown-importance stub-quality articles Unknown-importance start-quality articles Review changes to popular articles or changes to talk pages. Replace deprecated archival service links. Recategorize articles in Category:Security to more specific categories Fix something on the list of articles that need cleanup, including: Clarification needed Rewrite needed Expansion needed Style editing needed Update needed Orphaned (add links from other articles to these articles) Conflict of interest Original research Promotional tone Biographies of living persons (BLP) articles lacking sources Cites no sources Cites unreliable sources Review unreviewed articles, if you're a new pages patroller. Of the 3629 articles in this project 2011 or 55% are marked for cleanup, with 4098 issues in total. Editing resources: WikiProject Technology "generally reliable sources" list Wikipedia:Make technical articles understandable Wikipedia:Manual of Style § Technical language Wikipedia:Manual of Style/Computer science Computing Low‑importance This article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.ComputingWikipedia:WikiProject ComputingTemplate:WikiProject ComputingComputing Low This article has been rated as Low-importance on the project's importance scale.

@LuisVilla: FYI I think this recent NDSS paper[1] has a more concise definition of the attack surface than what I am currently read here, albeit it *seems* to be for the Linux kernel only... Fedcaster (talk)

@Fedcaster: The definition isn't Linux-only; it is generic. Definitely the best one I've seen in terms of rigor. But it is also incredibly... well, it isn't exactly plain english by any stretch :) Probably a good citation/reference, but not a definition I'd want to try to pull into the article? You're welcome to try, though! -LuisVilla (talk) 18:58, 8 November 2013 (UTC)Reply

It doesn't seem correct to say "how much (damage) can a piece of software do in its default configuration by unauthorized users" - it has nothing to do with "default configuration". One can change the configuration from the default, and now there is new 'attack surface'.

Also, note that the word "damage" (or something like it) is left out of that sentence.

--Rob Cranfill (talk) 15:56, 6 March 2008 (UTC)Reply

This article starts with a very odd definition of Attack Surface. It seems to say the attack surface is the extent of the vulnerabilities in the system, rather than the total of potential places an attack could start. The OWASP definition seems far clearer and more useful, because the whole point is you don't know where the actual vulnerabilities are otherwise you would've fixed them and have "no attack surface" SimonWiseman (talk) 17:46, 30 January 2013 (UTC)Reply

@SimonWiseman:, @Rob Cranfill: FYI, I'm starting to work on this page (Attack Surface); addressed both of your comments but would love more help if you have some cycles. -LuisVilla (talk) 20:35, 30 October 2013 (UTC)Reply

This section has multiple problems: It's likely LLM (see WP:AINB § User:Jgellatry); the author was blocked for advertising or promotion and has declared COI with HIPAA regulation; it is purely US-centric; and it gives far more detail than is needed. There's a discussion of this type of section, inserted into many articles very rapidly by the same author, at Wikipedia talk:WikiProject Computer security § Regulatory requirements sections.

I am taking the entire section out based on these considerations. If you revert it I won't contest, but please edit it thoroughly to address the problems above. M kuhner (talk) 13:26, 29 June 2026 (UTC)Reply