Attack Surface Analysis Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:30:42Z

Point to the official site

Jakub.mackowski: removed footer and the modification tag

2019-02-14T10:33:11Z

removed footer and the modification tag

Jakub.mackowski: migration to github

2019-02-13T07:59:04Z

migration to github

Show changes

Jim Bird at 16:39, 16 November 2017

2017-11-16T16:39:09Z

Jmanico: /* Other Cheatsheets */

2017-09-11T06:15:45Z

‎Other Cheatsheets

Jmanico: moving nav to bottom for mobile friendliness

2015-07-18T23:15:38Z

moving nav to bottom for mobile friendliness

Jim Bird at 15:46, 18 July 2014

2014-07-18T15:46:48Z

Jmanico at 03:34, 8 April 2014

2014-04-08T03:34:35Z

Jmanico at 04:58, 25 March 2014

2014-03-25T04:58:55Z

Jmanico: Glorious new template! woot! woot!

2014-03-25T04:58:07Z

Glorious new template! woot! woot!

← Older revision		Revision as of 14:30, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.md Attack Surface Analysis Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.html Attack Surface Analysis Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 1: / Line 1: @@
   __NOTOC__
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
 The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!
 Please visit [https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.md Attack Surface Analysis Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 115: / Line 115: @@
 = Authors and Primary Editors =
-Jim Bird - jimbird[at]shaw.ca
+Jim Bird - jim.bird[at]owasp.org
 <br>
 Jim Manico - jim[at]owasp.org

@@ Line 119: / Line 119: @@
 Jim Manico - jim[at]owasp.org
-== Other Cheatsheets ==
+= Other Cheatsheets =
 {{Cheatsheet_Navigation_Body}}

@@ Line 118: / Line 118: @@
 <br>
 Jim Manico - jim[at]owasp.org
 == Other Cheatsheets ==

@@ Line 82: / Line 82: @@
 Michael Howard at Microsoft and other researchers have developed a method for measuring the Attack Surface of an application, and to track changes to the Attack Surface over time, called the [http://www.cs.cmu.edu/~wing/publications/Howard-Wing03.pdf Relative Attack Surface Quotient (RSQ)]. Using this method you calculate an overall attack surface score for the system, and measure this score as changes are made to the system and to how it is deployed. Researchers at Carnegie Mellon built on this work to develop a formal way to calculate an [http://www.cs.cmu.edu/~pratyus/tse10.pdf Attack Surface Metric] for large systems like SAP. They calculate the Attack Surface as the sum of all entry and exit points, channels (the different ways that clients or external systems connect to the system, including TCP/UDP ports, RPC end points, named pipes...) and untrusted data elements. Then they apply a damage potential/effort ratio to these Attack Surface elements to identify high-risk areas.
-Note that deploying multiple versions of an application, or leaving old, backup and unused code increases the Attack Surface. Source code control and robust change management/configurations practices should be used to ensure the actual deployed Attack Surface matches the theoretical one as closely as possible.
+Note that deploying multiple versions of an application, leaving features in that are no longer used just in case they may be needed in the future, or leaving old backup copies and unused code increases the Attack Surface. Source code control and robust change management/configurations practices should be used to ensure the actual deployed Attack Surface matches the theoretical one as closely as possible.
 = Managing the Attack Surface =

@@ Line 5: / Line 5: @@
 | valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
 = What is Attack Surface Analysis and Why is it Important? =
 This article describes a simple and pragmatic way of doing Attack Surface Analysis and managing an application's Attack Surface. It is targeted to be used by developers to understand and manage application security risks as they design and change an application, as well as by application security specialists doing a security risk assessment. The focus here is on protecting an application from external attack - it does not take into account attacks on the users or operators of the system (e.g. malware injection, social engineering attacks), and there is less focus on insider threats, although the principles remain the same. The internal attack surface is likely to be different to the external attack surface and some users may have a lot of access.