Attack Surface

The attack surface is, in NIST's words, "the set of points on the boundary of a system, a system component, or an environment where an attacker can try to enter, cause an effect on, or extract data from" that system. Every open port, exposed service, browser extension, USB connection, wireless radio, account, and software dependency you run adds to it. The larger the surface, the more ways something can go wrong — so shrinking it is one of the highest-leverage moves in personal security, because unlike most defences it requires no new tools, only subtraction.

What expands your surface

For a sovereign Bitcoiner the surface includes the obvious — a hot wallet on an internet-connected phone — and a long tail of the less obvious: a router with default credentials, a miner's web dashboard reachable by every device on the LAN, UPnP silently opening inbound ports, cloud-synced clipboard or photo history that could capture an address or a seed, browser extensions with read-everything permissions, and a seed backup stored anywhere a remote attacker — or a search warrant aimed at a cloud provider — can reach. Software you run is surface too: every dependency, plugin, and auto-updating agent is code someone else can compromise upstream. Each integration added for convenience typically widens the surface; the drift is always in one direction unless you deliberately push back.

Mapping it honestly

You cannot reduce what you have not enumerated. The practical exercise is an inventory: What listens on my network? (Scan it — you will find things you forgot.) What accounts and API keys exist, and what can each one touch? Which devices hold or have ever held key material? Who besides me can physically reach the hardware? For a home mining and node setup this takes an evening, and the result usually surprises: forgotten services, an old phone with a wallet still installed, a dashboard exposed to the guest Wi-Fi. The map is also the input a proper threat modeling exercise needs — surface tells you where attacks can land; the model tells you which ones matter.

Reducing the surface

Reduction means eliminating unnecessary functionality, services, permissions, and entry points so an attacker simply has fewer options. Concretely: keep signing keys on a dedicated offline device — a hardware wallet exists precisely to take keys off the general-purpose surface; disable unused radios, services, and UPnP; remove extensions and apps that no longer justify themselves; segment the network so miners and IoT gear live on their own VLAN behind a deny-by-default firewall; and treat every new app, device, or integration as something that must earn the surface it adds. Prefer auditable, minimal software over feature-rich black boxes — a smaller codebase is a smaller surface. The goal is not zero surface, which is impossible if the system is useful, but the smallest surface consistent with what you actually need to do.

Surface, then layers

Attack surface reduction is the first half of a defensive posture; the second is accepting that whatever surface remains will eventually be probed, and layering controls behind it — the province of defense in depth and the "never trust, always verify" stance of zero trust architecture. The order matters: every door you remove is a door you never have to guard. Subtract first; fortify what is left.

Finally, treat the surface as something that regrows. Every firmware update, new gadget, convenience integration, and "temporary" port opening adds material back, so an annual re-survey — same questions, same scan, compared against last year's notes — keeps the map honest. The operators who stay safe are rarely the ones with the most tools; they are the ones with the shortest list of things that can be attacked at all.