Technical Report 1120004

Title: The Shape and Size of Threats: Defining a Networked Systems Attack Surface
Version (s): < 1 2 3 4 5 6 >
Obsoleted by published work
Authors: Eric Osterweil
Danny McPherson
Lixia Zhang
Date: 2014-03-27
Paper: Download here
Abstract: Security and privacy have become a major concern in our online lives. However as we have created complex and layered security services, it becomes increasingly difficult to quantify their vulnerability to compromise. Security solutions must strive for both their usability and understandability of their vulnerabilities. The concept of “attack surface” has emerged in recent years as a measure of such vulnerabilities, however it remains an open challenge how one may systematically quantify the attack surfaces of networked systems that have high degrees of interdependencies. In this work we propose a methodology to both quantify the attack surface and visually represent semantically different components (or resources) of such systems by identifying their dependencies. To illustrate the efficacy of our methodology, we examine two real Internet standards (the X.509 CA verification system and DANE) as case studies. We find that, with conscientious system design, one can minimize attack surface vulnerabilities without sacrificing availability and usability. Our methodology suggests that DANE quantifiably reduces attack surfaces for some popular websites (when compared to X.509 CA verification) by orders of magnitude by leveraging the already existing DNS/DNSSEC system. We believe this work represents a first step towards systemically modeling dependencies of (and interdependencies between) networked systems, and illustrates the usability benefits from leveraging existing services.
                author = {Eric Osterweil and Danny McPherson and Lixia Zhang},
                title = {The Shape and Size of Threats: Defining a Networked Systems Attack Surface},
                booktitle = {Verisign Labs Technical Reports},
                number = {1120004 version 5},
                year = {2014},