Your entry-point list is ranked by internet exposure — what does that ranking miss?

## Why the list needs an order at all A finished entry-point inventory for a real system runs to dozens of rows. You cannot threat-model all of them at equal depth, so the ranking is the decision about where the exercise spends its time. Getting the ranking wrong does not just misprioritise fixes; it means the deepest analysis is aimed at the wrong door. ## The three axes **Exposure — who can reach it.** This is a ladder, not a boolean: anyone on the internet, any authenticated user of the product, any tenant with a paid account, an employee on the corporate network, another workload holding a service credential, an operator on a bastion, someone with physical access. Most teams rank on this axis alone because it is the easiest to read off a network diagram. **Privilege — what the path can do once used.** Read one record belonging to the caller, read any tenant's records, mutate a balance, change an authorization rule, or obtain a shell in production. Privilege is the axis that decides how bad the outcome is, and it is often inversely correlated with exposure: the paths that fewest people can reach are frequently the ones that can do the most. **Attribution and monitoring — would you know who did it, and would you notice.** Does the path bind to an individual identity, is each use logged, is the log outside the reach of whoever used the path, and would an unexpected use raise an alert? A path that grants a lot but records nothing is worse than the same path with per-use approval and alerting, and this axis is what most rankings omit entirely. ## The worked case: a break-glass path An incident runbook contains an emergency access procedure. It exists for a good reason — if the identity provider is the outage, an SSO-gated admin console is useless — so it deliberately bypasses SSO and MFA, and the credential lives in a vault the on-call team can open. Scored on the three axes: exposure is low (bastion only, a handful of people); privilege is maximal (full production rights, including the ability to change the very controls that constrain other paths); attribution is weak (a shared credential means a misuse traces to the on-call rota, not a person). The adversary here is a compromised, phished or coerced operator, or anyone who obtains the vault entry. The assets are credentials and, importantly, **audit truth** — a path that can alter or delete records of its own use attacks the evidence, not just the data. That combination puts it at or near the top of the ranking, ahead of the public claim form, even though the form takes millions of requests and the break-glass path takes two a year. A ranking that cannot express this outcome is not measuring the right things. ## Failure modes in ranking - **Ranking by traffic volume.** Volume measures usage, not consequence. It systematically buries the administrative paths. - **Treating network position as a control.** "Internal only" is a statement about the current network, not about the adversary. Once you model a compromised operator, a malicious insider or a compromised workload, internal placement stops helping. - **Ranking by recency of change.** Recently touched code is a fine input to code review, but an untouched high-privilege path is not safer for being old — it is less reviewed. - **Collapsing to one number silently.** A single score with no statement of what dominated it cannot be argued with, and interviewers will push exactly there. - **Ranking paths instead of relationships.** Two routes with identical reach and rights are one row; the one route exempt from the shared authentication is its own row at a different rank. ## Defending a rank A rank is a claim, and senior interviews ask you to defend it out loud. The defensible form names the adversary and the asset: "I put the break-glass path above the public form because the adversary there is a compromised operator, the asset is production credentials and the audit record itself, and nothing on that path binds a use to a person. The form is reachable by everyone, but a successful abuse of it yields one claimant's data and is fully logged." That sentence survives challenge; "it scored 8.5" does not. It also tells you what would change the rank. Privilege drops if the emergency path grants a scoped role rather than everything. Attribution improves if each responder has an individual emergency identity, if the use requires a second approver, and if the resulting alert goes somewhere the user of the path cannot suppress. Those are changes to the axes; adding a control that leaves privilege and attribution untouched leaves the rank where it was. ## What the ranking is for Be clear that the output is *attention*, not a fix list. The top of the ranking is where you draw the boundary most carefully, where you analyse threats in the most depth, and where you insist on evidence rather than assurances. The bottom of the list is not declared safe; it is declared cheap to be wrong about this quarter.