Attack Vectors and Attack Surfaces
Identify common attack vectors such as email, removable media, and supply chain, and learn how to reduce the overall attack surface.
Attack Vectors and Attack Surfaces is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Attack Vector vs Attack Surface
An attack vector is one path in, like a phishing email. The attack surface is every possible path combined. Shrinking that surface is the goal.
Email as a Primary Attack Vector
Email is the most exploited vector by far — phishing links, malicious attachments, and impersonation. It works because a human still has to decide if it's real.
Removable Media as an Attack Vector
Removable media like USB drives can sneak malware right past network defenses. The famous Stuxnet worm spread this way, so many orgs disable USB ports entirely.
# Disable USB storage via Windows Registry (Group Policy equivalent)
# HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR
# Set Start value to 4 (disabled)
reg add 'HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR' /v Start /t REG_DWORD /d 4 /fSupply Chain as an Attack Vector
A supply chain attack hits a trusted vendor instead of you directly. The SolarWinds breach poisoned a software update that reached 18,000 organizations.
Web Applications as Attack Vectors
Web applications facing the internet are a big target — SQL injection, XSS, broken logins. A firewall helps, but it can't replace secure coding.
Wireless and Bluetooth Attack Vectors
Wireless adds invisible vectors. An evil twin is a fake Wi-Fi point copying a real network's name, so victims connect and route traffic through the attacker.
Direct-Access Physical Attack Vectors
Physical access beats most digital defenses — shoulder surfing, dumpster diving, tailgating through a door, or slipping in a hardware keylogger.
Social Engineering as an Attack Vector
Social engineering hacks people, not systems. Attackers use fake identities, fake urgency, and fake authority to get you to act before you stop and think.
Reducing the Attack Surface
Reducing the attack surface means closing exposure before attackers find it — disable unused services and ports, remove extra software, and apply least privilege.
# Check open ports and listening services (Linux)
ss -tlnp
# Or using netstat
netstat -tlnp
# Disable and stop an unnecessary service
systemctl stop cups
systemctl disable cups
# Verify it's no longer listening
ss -tlnp | grep cupsCloud and API Attack Surfaces
The cloud adds new exposure: public S3 buckets, over-permissive IAM, open APIs. Resources spin up fast, so CSPM tools scan continuously for misconfigurations.
IoT Devices Expanding the Attack Surface
IoT devices — cameras, thermostats, sensors — are often unpatched and ship with default passwords. Once hijacked into a botnet, they fuel huge DDoS attacks.
Quick Check
Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.
Lesson Recap
Quick recap: an attack vector is one path, the attack surface is all of them, top vectors include email and supply chain, and reduction shrinks risk. Next: threat intelligence.
Frequently asked questions
Is the “Attack Vectors and Attack Surfaces” lesson free?
Yes — the full text of “Attack Vectors and Attack Surfaces” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.
What will I learn in “Attack Vectors and Attack Surfaces”?
Identify common attack vectors such as email, removable media, and supply chain, and learn how to reduce the overall attack surface. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cloud & IT Cert Prep?
No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Attack Vectors and Attack Surfaces” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cloud & IT Cert Prep lesson?
Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Types of Threat Actors
- Attack Vectors and Attack Surfaces
- Threat Intelligence Sources and Feeds
- Indicators of Compromise (IoC)