OWASP has developed the Subtractive Security Top 10 Project, a security project that aims to remove vulnerabilities, rather than just detect them This article explores principles security substraction. . Cybersecurity is often defined as a collection of security products, alert monitoring, access logging and endpoint tools designed to prevent an attack.
Architectural Principles 4.
Security by Substraction principle Goal 1 Remove network exposure and access paths not required by the business, minimize unnecessary reachability 2 Reduce unnecessary trust relationships by removing excessive cross-system, identity and service dependencies 3 Reduce the exposure of credentials by limiting the availability, reuse, storage and transmission paths of credentials 4 Reduce privilege propagation by preventing the spread of administrative rights across systems and identities 5 Eliminate services, protocols, applications and configurations that can be abused by attackers to minimize executable attack paths 6 Reduce control-plane exposure by limiting access to cloud, identity, infrastructure and management interfaces 7 Minimize the attack-surface area by eliminating unused software, ports, accounts, APIs, and legacy components 8 Enforce deterministic communications with only required inbound, outbound and east-west traffic flows 9 Limit remaining attack paths segmentation, private endpoints, conditional access, and permission boundaries which removal is not possible 10 PER to measure structural improvement Path Erasure Rate (PER) to measure structurally eliminated eligible attack paths The framework assesses how many identified attack routes cease to function after a security update.
