What exactly is an attack surface, and where should a small company start reducing it?

Leaving Remote Desktop Protocol (RDP) open to the public internet is the number one cause of breaches for small businesses. Automated scanning bots are constantly indexing open ports across the web, hammering away for days to crack weak passwords. That open port is definitely the main reason the auditor flagged your attack surface.

The quickest thing you can do right now: call the IT firm you pay for annual support and ask them to run an external port scan on your office's public IP. Tell them to close any entry points exposed to the internet and put remote access behind a VPN.

We also use remote desktop directly so our remote staff can connect. like does setting up a VPN require an expensive software license, or is it just a built-in feature on our existing network router?

Most current enterprise-grade modems and routers come with a built-in VPN server feature. Your IT support provider can set this up with a couple of hours of configuration without requiring you to buy extra hardware. If it's covered under your contract, it shouldn't cost you anything extra.

We had a similar scan done at our 15-person consulting firm. It turned up 6 unnecessary ports exposed to the outside, 3 old intern accounts, and an outdated NAS device. Cleaning all that up took our IT guy half a day and significantly reduced our attack risk.

You mentioned employees check company emails from their personal phones. Is there a screen lock requirement on these devices, or can you remotely wipe the company account if a phone gets stolen? Physical device security is also an integral part of the attack surface.

In short, the attack surface is all the entry points of your office facing the internet. Closing the RDP port, setting up a VPN, enforcing two-factor authentication, and deleting unnecessary accounts will bring this surface down to a secure level in no time.

Great work.

Same here.

Generally correct, but one part is missing. The biggest time-waster for us was not knowing who had the final say.

Hope this helps.

Sorry, but this doesn't apply in every case. Taking measures without an inventory leaves doors you haven't seen open.

If it's your first time, start small; scaling comes later. Correct me if I'm wrong.

You're right. honestly start with a small trial; don't commit to everything at once.

Of course, it varies if your situation is different.

the opposite happened to me, that's why I'm writing. don't rely on a single measure; go layer by layer.

if I were you I'd go this route.

The discussion got scattered, let me summarize. Solutions that work at a small scale collapse when you grow; I learned this late.

Proven by experience.

Let me share my experience. Processes without records never improve, because you don't know what to fix.

When you try to change everything at once, nothing settles. Just leaving this note, it might be useful.

I went through the same thing two years ago. Taking notes for two weeks yields better results than a six-month estimate.

If you post the result here, it will help others too.

There's also a measurement aspect to this. The real issue isn't the number, but what it's based on.

When you try to change everything at once nothing settles.

I went through the same thing.