Attack Surface Measurement

Contents
Please send comments to Pratyusa [pratyus@cs.cmu.edu].

Introduction

Measurement of security, both qualitatively and quantitatively, has been a long standing challenge to the research community and is of practical import to software industry today. Software industry has responded to demands for improvement in software security by increasing effort for creating ``more secure'' products and services. How can industry determine whether this effort is paying off and how can consumers determine whether industry's effort has made a difference? Our work looks at an important question faced by both industry and consumers today: How can we quantify a software system's security?

We propose to use the measure of a software system's attack surface as an indicator of the system's security. Intuitively, a system's attack surface is the set of ways in which an adversary can enter the system and potentially cause damage. Hence the larger the attack surface, the more insecure the system.

People  Publications
The Windows and Linux measurement results show that the attack surface measurement holds promise. The measurement methods, however, were based on intuition and relied on the history of attacks on Windows and Linux. In this paper, we introduce a systematic method for measuring a system's attack surface. We introduce the formal entry point and exit point framework to identify the resources that are part of the attack surface. We also introduce the notion of attackability to estimate a resource's contribution to the attack surface.
In this paper, we generalize the RASQ approach and measure the attack surfaces of four versions of Linux. This is our first attempt at formalizing the notion of a system's attack surface.
Michael Howard of Microsoft informally introduced the notion of Relative Attack Surface Quotient (RASQ) for the Windows operating system.  In this paper, Pincus and Wing extend Howard's method and measure the attack surfaces of seven versions of Windows.

Talks
Other Articles