The key to effective enterprise cybersecurity is reducing the attack surface of all assets as much as possible. Attack surface reduction starts at the physical hardware level. Different devices have an array of physical components that provide functionality for various tasks and services. Network connectivity, external media access, and storage are all powered by physical components. However not every device needs every component that was installed into it out of the box. This is especially the case for servers that are designed to perform one or more network services constantly without change. However if extra components are left attached, they can be used by adversaries with physical access to penetrate the system. To mitigate this threat, unnecessary components should be removed.

Specific components that should be removed are:

  1. DVD/CD/BluRay Drives: Many older systems contain drives providing read/write or read only access to external disks. Organizations may have cases where these components are still needed, such as creating backups or accessing older software or media files. However in many cases, these components are unnecessary. A major risk posed by these drives is booting from external media. Adversaries can create bootable live media that allows them to boot from a DVD into a live operating system, which can then be used to maliciously access the rest of the system. To mitigate this risk, organizations should remove DVD/CD/BluRay drives from systems unless their is an underlying need for their presence.
  2. Floppy Drives: Going back even further, some very old desktop or server systems have floppy disk drives installed. If an organization purchases refurbished desktop computers for their environment, there is a chance of floppy drive readers being present. In the 2020s these drives are almost certainly unneeded, and should be removed.
  3. Network Cards: Many desktop computer systems contain both wired and wireless network interface cards. This gives end users more flexibility when connecting to networks. However in most cases, users only need one or the other. A desktop workstation that stays put at a desk will only need Ethernet connectivity. A laptop or kiosk station connecting via WiFi should not have its Ethernet card exposed. Adversaries could use the secondary network adapter as a covert means of accessing/controlling the system. To mitigate this risk, administrators should remove the secondary network card if possible. In some cases, the network cards are built into the motherboard and cannot be disconnected. In such cases, the network adapters can be turned off via the operating system, such as through the Windows Network and Sharing Center. While not as effective, this approach does prevent easy access to the extra adapters.
  4. Unused USB Slots: The use of USB is still a necessity in many organizations, especially on employee endpoint devices. However server systems generally have less of a need for all USB ports to be functioning constantly. There are a wealth of devastating attacks that can be used by adversaries to target systems through USB. There are USB kill switches that appear to be legitimate USB drives, but actually issue a lethal charge to a system's motherboard when connected, effectively frying the device. Keyloggers can also be placed on a USB device and connected to the back of a system to covertly extract user credentials and other data. These risks are of special concern to organizations that provide public access to systems, such as libraries or hotels. A big issue with addressing these threats is the built in nature of USB ports. They cannot be simply disconnected with a screw. However organizations can take precautions by disconnecting the USB power cable from the motherboard or simply disabling the individual USB drivers in the operating system. At the very least, this will prevent attackers from using the USB port to gain underlying access to the operating system, since the OS will no longer know the USB ports exist.
  5. Webcams: In today's digital landscape, webcams have become a necessity due to the widespread use of video conferencing tools and remote work. Most all laptops come with webcams built in, and many organizations purchase external webcams to use with desktop workstations. However webcams can be hacked, and oftentimes adversaries can access webcam feeds covertly without any indication to the targeted user that the webcam is on. This category of attack is known as camfetching. The difficulty with webcams is that they are necessary in today's world and cannot be easily removed from most laptop devices. However there are steps that can be taken to limit the effects of camfetching attacks. Some laptop manufacturers include a privacy shutter, that can be slid closed over the webcam when not in use. Some privacy aware users opt to just place a piece of duck tape over the webcam. If possible, organizations should try to buy laptop models that include privacy shutters. For desktop workstations, users can simply opt to unplug their webcam when not in use.