OWASP's Subtractive Security Project Aims to Erase Attack Paths
The OWASP Subtractive Security Top 10 project, led by Christopher Frenz, introduces a new paradigm focused on eliminating exploitable capabilities and measuring 'Path Erasure Rate' to enhance security.
In a significant shift from traditional security approaches, the OWASP Subtractive Security Top 10 project is championing a methodology that prioritizes the proactive removal of attack paths rather than solely focusing on detection and response. Spearheaded by Christopher Frenz, this initiative aims to fundamentally change how organizations approach cybersecurity by identifying and eliminating exploitable capabilities before they can be leveraged by attackers.
The project's core philosophy is rooted in the principle of 'subtractive security,' which seeks to reduce an organization's attack surface by deleting potential vectors that attackers could exploit. This contrasts with the prevailing 'additive' model, where security teams often layer on more tools and defenses, leading to increased complexity and alert fatigue. Frenz argues that organizations have reached a point where adding more security solutions is no longer effective, and the focus must shift to removing what is unnecessary and inherently risky.
Central to the Subtractive Security project is the concept of the 'Path Erasure Rate' (PER), an engineering standard designed to quantify security improvements. PER is calculated as a fraction: the number of attack paths erased over the total number of paths eligible for erasure. This metric encourages organizations to systematically identify and eliminate vulnerabilities, providing a measurable way to track progress in reducing their attack surface. The project provides nine lists of exploitable capabilities, categorized by platform, including Windows, Linux, macOS, Active Directory, AWS, M365, network, and IoT, along with a universal list of foundational principles.
Frenz draws a parallel to reliability engineering, where failure modes are addressed first through architectural erasure, then constraint, and finally monitoring. He contends that in cybersecurity, the attack path is the equivalent of a failure mode. By mimicking this hierarchy, the project advocates for eliminating attack paths as the primary defense mechanism, constraining those that cannot be fully eliminated, and resorting to monitoring only as a last resort. This approach, Frenz suggests, can significantly improve an organization's ability to detect genuine threats by reducing the noise from false positives and alerts on paths that should have been removed.
The project's methodology also has implications for security budgeting and vendor management. Frenz posits that a strong PER score could be used to justify letting renewals for certain detection and response tools lapse, arguing that while incident response remains crucial, it should not be the primary focus. The emphasis should be on architecting systems that are inherently more secure and less susceptible to attack in the first place, akin to building a fire-resistant structure rather than solely relying on a robust fire department.
Implementing subtractive security requires a diligent analytics phase to understand which functionalities are essential for business operations and which merely serve to keep attack paths open. The goal is not to eliminate all possible attack paths, but rather to remove those that offer no legitimate business purpose. For instance, the project highlights that a browser should not have a legitimate need to launch PowerShell, and eliminating such unnecessary capabilities can significantly reduce risk.
The PER metric is designed to be resistant to gaming. It uses a binary assessment – a path either exists or it does not – and is intentionally unweighted to prevent organizations from manipulating risk scores by reclassifying assets. This approach ensures that the metric reflects actual security posture rather than a paper-based optimization, acknowledging that an attacker does not differentiate between a critical and non-critical asset when seeking a foothold.
The OWASP Subtractive Security Top 10 lists and the PER specification are publicly available on GitHub, inviting broader community engagement and adoption. By shifting the focus from adding more defenses to strategically subtracting vulnerabilities, the project aims to provide a more effective and sustainable path toward robust cybersecurity.