CVE-2023-49722

Least privilege reduces the privileges available through existing interfaces but does not remove the interfaces themselves.

Separating user and system functionality reduces reachable entry points and therefore shrinks the attack surface.

Prioritization helps focus reduction efforts on high-value assets but does not itself limit the quantitative attack surface.

Hardened baselines and configuration management directly reduce unnecessary services, ports, and features that enlarge attack surface.

Restricting execution to only permitted software prevents addition of extraneous components that increase attack surface.

Secure SDLC practices explicitly include attack-surface measurement and minimization during design and implementation.

Network security controls (firewalls, segmentation, hardening) shrink the externally reachable attack surface.

Restricting network services reduces exposed interfaces, though broader attack-surface decisions may still remain.

A.8.22's network domain segregation and perimeter gateways directly reduce the attack surface by limiting exposure and controlling inter-domain traffic based on trust/criticality; the bounded remainder is internal attack surface within a single domain (or misconfigured gateways), which the clause does not reach.

Secure SDLC practices include attack-surface reduction reviews during design and release.

A.8.26 only requires that security requirements (including attack-surface reduction) be identified and specified during development or acquisition; it does not itself remove the excessive attack surface from any delivered product.

A.8.27 mandates security-by-design principles (least privilege, default deny, zero-trust, attack-surface reduction via hardening and reviews) that can shrink the attack surface below the undesirable maximum, but the clause is about establishing/applying/reviewing principles rather than mandating any specific quantitative bound or guaranteeing the surface never exceeds it.