19. The Thousand Doors
Domain: Attack Vectors, Attack Surface POV: Sable Reading time: ~15 minutes
The Shroud did not simply press against the walls, Sable had learned. It searched. It probed. It found every opening, every gap, every forgotten passage that no one had thought to seal because no one had remembered it existed. And it did this not randomly but systematically — testing each potential entry point in sequence, cataloguing which ones were strong and which were weak, and concentrating its pressure where the resistance was least.
This was what the treatises called an attack surface: the total set of ways that an adversary could attempt to breach a system. And the Citadel’s attack surface, Sable had discovered, was enormous.
The ventilation shaft that the Shroud had nearly breached was only one of dozens of similar shafts scattered across the city — small, overlooked openings that had been designed to circulate air through the gear-chambers and the maintenance tunnels and the residential districts, and that no one had ever considered as potential points of entry for a hostile force. The service doors that the Shroud had been testing were only a fraction of the total number of doors in the Middle Ring, each one representing a vulnerability that needed to be assessed and reinforced or sealed. The old maintenance passages that Thread had mapped — the forgotten routes that had saved the city during the gate failures — were themselves potential attack vectors, if the Shroud ever discovered them and learned to navigate them.
And beyond the physical entry points were subtler forms of access. The communication network that connected the Citadel to the Archipelago — if the Shroud could corrupt a lighthouse’s signal, it could send false messages that would be trusted because they came from a trusted source. The supply chain that brought materials from the outer territories — if the Shroud could infiltrate a shipment of gear-oil or a consignment of brass fittings, it could introduce corruption directly into the city’s infrastructure. The people themselves — citizens and archivists and engineers and magistrates — who could be compromised by manipulation or blackmail or the simple, corrosive pressure of fear.
“Every system has an attack surface,” Sable said to the council, spreading a map of the city across the table — a map covered in red markings, each one indicating a potential point of entry that had been identified. “Doors. Windows. Ventilation shafts. Communication channels. Supply routes. The people who operate the systems. The people who maintain them. The people who trust them. Every single one of these is a way that the Shroud — or Vale, or any other adversary — could attempt to reach the heart of the city.”
“And we cannot defend them all,” Kip said, the lesson of the risk calculation still fresh in his mind.
“No,” Sable said. “We cannot. That is why we need to reduce the attack surface. Close the doors that do not need to be open. Seal the passages that do not need to be used. Remove the access points that are not essential to the city’s function. The fewer ways there are to enter, the fewer ways we have to defend.”
The attack surface reduction became, over the following weeks, the most tedious and most important project the fellowship had ever undertaken.
Wren and the engineers sealed ventilation shafts that were not essential for air circulation, replacing them with smaller, more secure alternatives that could be more easily defended. Thread mapped every communication channel between the Citadel and the outside world — not just the lighthouses but the courier routes, the trading posts, the unofficial networks that had grown up over centuries of informal contact — and identified which ones could be temporarily suspended and which ones needed to be maintained with enhanced verification. Quill drafted new procedures for supply inspections, requiring that every shipment entering the city be verified at three separate checkpoints before being cleared for distribution.
And Sable — Sable audited the people. Not in the way that the old authorization system had audited them, with its informal customs and its unexamined assumptions. She audited them systematically, using the framework that Quill had designed and the access logs that Thread had compiled and the risk assessment methodology that Kip had developed. Every person with access to a critical system — an engineer with access to the gear-chambers, an archivist with access to the restricted stacks, a magistrate with access to the Spire — was reviewed to determine whether their access was still necessary and whether their authorization was still valid.
The process was invasive and uncomfortable and deeply resented by many of the people it affected. Senior archivists who had held their positions for decades protested that they should not have to justify their access to the very institutions they had spent their careers protecting. Magistrates who had served the city faithfully for generations objected to being treated as potential threats. Citizens who had been crossing the Span of Accord every day for thirty years complained about the new verification procedures that slowed their passage and questioned their legitimacy.
“The complaints are a sign that the system is working,” Sable said to the council, when the latest round of protests was presented. “Before the crisis, no one had to justify their access because no one was questioning whether they should have access. That is exactly why Vale was able to do what he did. He did not need to justify his presence in the Restricted Archive or his annotations in the Founding Laws — he was the Chief Archivist, and his access was assumed rather than verified.”
She looked around the chamber at the assembled magistrates and archivists and engineers. “The old world is gone. The world where we assumed that people could be trusted because of their titles or their seniority or their years of service. The new world requires us to verify what the old world assumed. And verification will always be more uncomfortable than assumption. But it is also more reliable. And in a crisis, reliability is what matters.”
The attack surface reduction saved the city three weeks later, when a courier arrived from the Archipelago carrying a sealed container that was supposed to contain trade documents. The container passed the first inspection checkpoint — the documents appeared authentic, and the courier had the proper credentials. It passed the second inspection checkpoint — the seals were intact, and the manifest matched the contents as described. But at the third checkpoint — the one that Sable had insisted on adding, over the objections of the trade guilds and the courier’s association — the inspectors opened the container and found, beneath the trade documents, a small glass vial that contained a sample of the Shroud.
The vial was sealed, but barely — the glass was thin and the stopper was loose, and the inspectors’ report noted that it would almost certainly have broken if the container had been opened in the heart of the city rather than at the outer inspection point. The Shroud sample, once released, would have begun corrupting whatever it touched — the Archive of Record, perhaps, or the Spire’s gear-chambers, or one of the residential districts that had been evacuated and was now being repopulated.
“The courier did not know what he was carrying,” Thread reported, after interviewing the man. “He was paid to deliver the container by an intermediary in the Archipelago — one of the agents of the faction that Quill’s dossier exposed. The intermediary told him it was routine trade correspondence. He had no reason to suspect otherwise.”
“The attack surface reduction worked,” Sable said, and there was no triumph in her voice — only the quiet, exhausted satisfaction of someone who had been proven right about something she had desperately hoped to be proven wrong about. “If we had not reduced the city’s exposure — if we had not sealed the unnecessary passages, suspended the non-essential communications, and added the third inspection checkpoint — that vial would have reached the heart of the city. And we would be dealing with a Shroud contamination at the center of our defenses, not at the perimeter where we could contain it.”
She looked at the map of the city, with its red markings indicating potential attack vectors, and she saw, in the pattern of sealed passages and closed doors and suspended channels, a shape that had not been visible before: the shape of a city that had been systematically hardened against attack. Not perfectly hardened — no system was ever perfectly hardened. But hardened enough that the adversary’s most obvious paths had been blocked, and the adversary was forced to search for paths that were narrower and riskier and more likely to be detected.
“Attack surface reduction is not about making the city impenetrable,” Sable said. “It is about making the city harder to penetrate — closing the easy paths, narrowing the obvious routes, forcing the adversary to work harder for every inch of ground. And that, in the end, is what defense is: not a single perfect barrier, but a series of choices, each one making the adversary’s task more difficult and more dangerous and more likely to fail.”