CompTIA CySA+ (CS0-003)Reporting and CommunicationMedium
A cybersecurity analyst is preparing a quarterly report for the Chief Information Security Officer (CISO) and the Board of Directors. The report aims to demonstrate the organization's progress in reducing its overall attack surface. The organization has recently implemented a strict patching policy, decommissioned several legacy systems, and is enforcing a least privilege model. Which of the following KPIs would BEST illustrate these efforts for a strategic audience?
- ANumber of critical vulnerabilities remediated per month.
- BMean time to patch (MTTP) for critical vulnerabilities.
- CPercentage reduction in open ports on internet-facing systems.
- DNumber of security awareness training completions.
Show answer & explanationAnswer & explanation
Correct answer: C. Percentage reduction in open ports on internet-facing systems.
Reducing open ports on internet-facing systems directly correlates with attack surface reduction by limiting entry points for potential attackers. This metric clearly demonstrates the impact of efforts like decommissioning legacy systems and enforcing least privilege from a network exposure perspective, which is strategic and easily understood by the Board.
Why the other options are wrong
- A. While important, 'number of remediated vulnerabilities' is more tactical than strategic and doesn't directly show the 'surface' reduction.
- B. MTTP is an operational metric focusing on efficiency of patching, not directly measuring the overall 'attack surface' reduction.
- D. Security awareness training reduces human risk but doesn't directly measure the technical 'attack surface' reduction from patching or decommissioning systems.
Attack Surface Reduction KPI
A Key Performance Indicator (KPI) used to measure the effectiveness of efforts to minimize the number of potential entry points or vulnerabilities an attacker could exploit to compromise a system or network.
- Focuses on limiting exposure points.
- Examples include reducing open ports, deprecating services, decreasing software complexity.
- Strategic for demonstrating proactive security posture to leadership.
Memory trick: Attack Surface: Less Gates, Less Ways In.