Reduction of the attack surface: is that specific enough?

[ioggstream]

I expect

• "reduction of the attack surface" should be described and classified better
• can be implemented via various techniques, such as software inventory and application and configuration hardening
• is it PatchManagement ?

Note

Using d3fend classification, this is related to:

        # PlatformHardening
        - LocalFilePermissions
        - SystemConfigurationPermissions
        # ApplicationHardening 
        - DeadCodeElimination
        - ApplicationConfigurationHardening
        # AssetInventory
        - SoftwareInventory