Identifying the Attack Surface