Comparing and applying attack surface metrics
Jeffrey Stuckman, James M. Purtilo · 2012
A software system's attack surface metric measures the freedom of a potential attacker to influence the system's execution, potentially exploiting a security vulnerability. Existing attack surface metrics aim to measure the security impact associated with deploying an application or component; however, a systematic evaluation of various metrics' suitability for this purpose has not yet been performed. We outline a framework for formalizing code-level attack surface metrics and deployment-time activities that reduce the attack surface of an application. We also outline a tool for measuring the attack surface of a deployed web application, along with a method to retrospectively evaluate an attack surface metric over a corpus of known vulnerabilities.