Microsoft software security expert Michael Howard defines some heuristics for determining code review in "A Process for Performing Security Code Reviews". Which of the following heuristics increase th

While code written in C/C++/assembly language can lead to memory-related vulnerabilities, the language itself does not inherently increase the attack surface; rather, it impacts the likelihood of vulnerabilities.

Code listening on a globally accessible network interface expands the attack surface by making the application remotely reachable to a vast number of potential attackers.

Code that changes frequently might introduce new vulnerabilities if reviews are inadequate, but frequent changes themselves do not directly expand the attack surface, which refers to the points of interaction.

Anonymously accessible code removes the authentication barrier, allowing anyone to interact with and potentially exploit the application, thereby increasing its attack surface.

Code that runs by default provides a persistent target for attackers, as it is always active without requiring explicit user intervention, which extends the attack surface.

Code that runs in an elevated context (e.g., with administrative privileges) makes a successful compromise far more impactful, making the application a more attractive target and effectively increasing the severity component of the attack surface.