An estimation of attack surface to evaluate network (in)security