How to Protect Application Attack Surfaces