Attack Surface Management: Avoiding Device Whac-a-Mole