The Open Worldwide Application Security Project (OWASP) has launched a groundbreaking initiative known as the Subtractive Security Top 10 Project. This effort is designed to enhance cybersecurity by removing potential attack paths, rather than solely relying on detection and monitoring strategies.
Revolutionizing Cyber Defense
Traditional cybersecurity measures often focus on enhancing security with additional products and tools like alerts and access controls. However, OWASP’s new project introduces a paradigm shift by asking security teams to consider what can be removed to hinder or nullify potential attacks.
The principle behind this initiative is straightforward: attackers can only exploit existing pathways. By eliminating unnecessary access points, trust relationships, and network exposures, organizations can significantly reduce the avenues available for attackers to exploit.
Subtractive Security Explained
OWASP outlines subtractive security on GitHub, emphasizing structural changes to eliminate attack vectors. These security controls are prioritized based on their efficiency in reducing the attack surface.
The first step involves architectural deletion, where attack paths are completely removed. This includes disabling legacy protocols, shutting down unused services, and revoking superfluous administrative privileges. The second step, architectural constraint, is applied when complete removal isn’t feasible, using methods like network segmentation and privilege restrictions.
Monitoring and detection are placed last in this hierarchy. While logging and alert systems remain crucial, OWASP emphasizes that detection alone cannot eliminate the paths that attackers might exploit.
Strategic Implementation and Measurement
The project introduces the Path Erasure Rate (PER) as a metric to evaluate security improvements. PER calculates the proportion of attack paths eradicated through structural changes, offering a quantitative measure of risk reduction.
The Subtractive Security Top 10 framework supports a repeatable process of identifying attack paths, measuring exposure, and systematically removing or constraining these paths. This process is continuously refined to enhance security architecture.
Moreover, the project provides universal security principles applicable across various technologies, offering specific guidance for platforms such as Windows, Linux, and AWS. This adaptability is crucial as attackers often navigate between different technological layers post-compromise.
Organizations can leverage this framework to diminish risks, such as ransomware exposure, by removing unnecessary accounts and restricting internal communications, thus minimizing potential attack routes.
OWASP’s Subtractive Security Top 10 Project is publicly accessible under the Apache License 2.0, enabling security professionals to review, adapt, and contribute via its GitHub repository. This collaborative approach aims to foster a more secure digital environment.
