Which of the following can increase an attack surface?

An attack surface represents the total number of points or vectors through which an attacker can attempt to enter or extract data from a system. Old or unused code, often referred to as "dead code," directly contributes to expanding this surface. This code is no longer maintained or tested as part of the active development lifecycle, yet it remains within the production environment. It can harbor unpatched vulnerabilities, outdated dependencies, or forgotten access points that an attacker could discover and exploit. By increasing the volume of code and potential entry points without active oversight, it enlarges the overall attack surface.

B. Vulnerability scanning: This is a defensive process used to identify and report on weaknesses within the existing attack surface, not to increase it.
C. Mapping of an attack surface: This is an analytical activity to document and understand the components of an attack surface, typically as a precursor to reducing it.
D. Penetration scanning: This is a method of testing the security of the current attack surface by simulating an attack; it does not add new components to it.

1. National Institute of Standards and Technology (NIST). (2021). Special Publication (SP) 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations. In the glossary (Appendix F), an attack surface is defined as: "The set of points on the boundary of a system, a system element, or an environment where an attacker can try to enter, cause an effect on, or extract data from that system, system element, or environment." Old code provides such points.

2. OWASP Foundation. (2023). Attack Surface Analysis Cheat Sheet. This document outlines that a primary goal is to "reduce the attack surface." It identifies "The code in the application itself" as a core part of the surface. Logically, more code, especially unmaintained and unused code, increases the size and complexity of this surface.

3. Manadhata, P. K., & Wing, J. M. (2011). An attack surface metric. IEEE Transactions on Software Engineering, 37(3), 371-386. This foundational academic paper formalizes the concept of an attack surface. The authors state, "As a system evolves, its attack surface changes. For example, adding a feature might increase the attack surface..." Leaving old or unused code from previous features is a direct way the surface remains larger than necessary. (DOI: https://doi.org/10.1109/TSE.2010.60)