Suppose the security program aims to reduce threats to the business by mitigating cybersecurity risk. In that case, the first step should be to assess the network attack surface and then eliminate unnecessary access points:
- Which assets are most critical to the business – which would impact the business most if disrupted, damaged, or exposed?
- What and where are the organization's most exploitable vulnerabilities – phishing, insecure codes, or unpatched systems?
- How could an attacker reach the 'crown jewels' if your initial vulnerabilities are exploited?
- How are workloads and applications interconnected?
- What are the most likely pathways an attacker could use to move toward business-critical assets?
