A Practical Guide to Attack Surface Management