Skip to main content

Annex I, Part I, Req 2j: Limiting Software Attack Surfaces

The more ways there are to interact with your software, the more opportunities there are for attackers. The EU Cyber Resilience Act (CRA) addresses this by requiring that products with digital elements shall, where applicable, "be designed, developed and produced to limit attack surfaces, including external interfaces" (Annex I, Part I, Point 2j).

What is an Attack Surface?​

An attack surface is the sum of all possible points where an unauthorized user (an attacker) can try to enter data into or extract data from your software, or otherwise interact with it to cause an impact. This includes:

  • User Inputs: Forms, command-line arguments, configuration files.
  • Network Interfaces: Open ports, network protocols listened to (e.g., HTTP, FTP, custom protocols).
  • APIs: Both those your software consumes and those it might expose.
  • File System Interactions: Files read from or written to.
  • Dependencies: Vulnerabilities in third-party libraries or SDKs become part of your attack surface.
  • User Accounts and Privileges: More privileged accounts represent a larger potential impact if compromised.

How to Limit Attack Surfaces​

  1. Minimize Features: If a feature isn't essential, consider removing it. Fewer features often mean fewer potential vulnerabilities.
  2. Disable Unused Interfaces/Ports/Protocols: If your software doesn't need a particular network port open, close it.
  3. Principle of Least Privilege: Ensure components of your software run with only the permissions they absolutely need.
  4. Reduce External Dependencies: Carefully vet and minimize the use of third-party code.
  5. Strong Input Validation: Treat all external input as untrusted.

Design, Development, and Production​

This is not just a release-time check. Limiting attack surfaces should be a conscious effort throughout the entire software lifecycle:

  • Design Phase: Make architectural choices that reduce complexity and exposure.
  • Development Phase: Implement robust input validation and secure coding practices.
  • Production/Deployment: Configure systems securely, closing unnecessary ports and services.

Key Takeway​

Under Annex I, Part I, Point 2j of the CRA, you must actively work to limit your software's attack surface. This means reducing the number of potential entry points and interaction methods for attackers by minimizing features, interfaces, and dependencies, and applying the principle of least privilege.