attack_surface View

The attack_surface view identifies public internet-facing entry points, edge firewalls, DMZ trust boundaries, and active software vulnerabilities across the enterprise perimeter.

---

Visual Projection

Attack Surface View illustrating public ingress entry points, DMZ perimeters, and CVE vulnerabilities

---

Purpose & Target Audience

• Target Audience: Security Operations (SecOps), Cloud Security Architects, Penetration Testers, CISO.
• Primary Use Cases:
  • Auditing all software assets with internet_facing == true.
  • Verifying that public endpoints route strictly through Web Application Firewalls (WAF) and DMZ perimeters.
  • Identifying unpatched vulnerability entities (CVEs) exposed to the public internet.
  • Minimizing external exposure during zero-trust modernization.

---

Supported Entity Types

Entity Type	Role in Attack Surface	Description
system, app	Exposed Entry Point	Public websites, customer APIs, and ingress controllers.
trust_boundary	Security Perimeter	DMZs, edge networks, and protected internal subnets.
vulnerability	Exposure Flaw	CVE identifiers, CVSS ratings, and unpatched weaknesses.
control	Perimeter Defense	Cloudflare WAF, DDoS protection, and TLS termination.
actor	External Origin	Anonymous web users, external partners, or potential adversaries.

---

Supported Relationships & Verbs

Relationship Verb	Source Entity	Target Entity	Typical Representation
targets	vulnerability, threat	app, system, infra	Exposure / attack vector edge
protects	control, trust_boundary	app, system	Perimeter defense edge
encloses	trust_boundary	app, system	Network containment boundary
flows_to	actor	app	Public ingress traffic stream

---

Filtering & Layout Recommendations

• Recommended Layout: auto_layout TopToBottom or LeftToRight (public internet → DMZ → internal).
• Common Predicates:
  • include * where internet_facing == true: Exclusively filter public assets.
  • include vulnerability where cvss_score >= 7.0: High and critical CVEs.

---

Complete DSL Example

views {
    attack_surface v_external_perimeter "External Attack Surface & Vulnerabilities" {
        # Select all public internet-facing elements and high-severity CVEs
        include * where internet_facing == true
        include trust_boundary where boundary_type == "DMZ"
        include vulnerability where cvss_score >= 7.0
        include control where control_category == "Network Security"

        # Show protection and vulnerability target lines
        include_verb protects both
        include_verb targets both
        include_verb encloses both

        # Layout from external untrusted traffic down to internal networks
        auto_layout TopToBottom

        # Red alert highlight for critical CVEs
        style vulnerability where cvss_score >= 8.0 {
            css_class "cve-critical-pulse"
            icon "alert-octagon"
        }
    }
}