OWASP Subtractive Security Project: Measuring Attack Path Mitigation

OWASP’s subtractive security initiative focuses on eliminating attack vectors to enhance organizational security through proactive risk reduction.

OWASP’s Subtractive Security Initiative

OWASP’s subtractive security initiative evaluates the elimination of attack vectors within organizational environments. An adversary who persuades a user to open an attachment gains access to the system’s remaining permissions: a domain service account, unrestricted outbound connectivity, or a scripting engine available for exploitation.

Key Components of the Framework

Christopher Frenz advocates for removing these capabilities before developing detection mechanisms. Frenz oversees the OWASP Subtractive Security Top 10, a framework consisting of nine platform-specific lists paired with an engineering standard known as Path Erasure Rate.

Traditional Security Models and Alert Fatigue

Organizations that have relied on layered security tools like EDR, SIEM, and NDR over the past decade now face alert fatigue from monitoring paths that could have been eliminated. The lists identify which attack vectors to remove, covering Windows, Linux, macOS, Active Directory, AWS, M365, network infrastructure, and IoT devices, alongside foundational principles applicable across all platforms.

Path Erasure Rate (PER) and Hierarchy of Efficacy

The ranking system originated from reliability engineering practices, where failure modes are addressed through architectural erasure, constraint, or monitoring. In cybersecurity, attack paths function as failure modes. The project’s Hierarchy of Efficacy mirrors this approach by prioritizing attack path elimination as the primary defense, constraining unavoidable paths, and reserving monitoring for residual risks.

Alert Fatigue and Detection Capabilities

Alert fatigue serves as evidence that the traditional additive security model has reached its limits. Implementing this hierarchy enhances detection capabilities by reducing alert noise, as erased paths no longer contribute to false positives, according to Frenz.

EDR Contract Dilemma and Security Priorities

A framework that positions monitoring as a secondary priority can be challenged in budget discussions by arguing against endpoint detection renewals. The standard does not advocate for discarding detection and response capabilities but emphasizes that they should not be the primary defense strategy.

Focus on Proactive Risk Elimination

Security teams currently focus on improving detection tools and response efficiency, akin to prioritizing fire department readiness over building fire resistance. The standard argues that while emergency response remains essential, the core objective should be minimizing vulnerabilities and designing systems that resist exploitation.

Path Erasure Rate (PER) Metric

The Path Erasure Rate (PER) metric calculates the ratio of erased paths to eligible paths. Assessors determine the denominator by inventorying accessible assets, leading to variations in results between teams evaluating the same environment. PER is scoped to specific operational boundaries, such as an entire Active Directory forest or cloud tenant, ensuring that narrowing the scope reflects reduced coverage rather than fabricated security.

Manipulation and Validity of PER

Manipulating the metric by excluding critical assets does not erase risks but leaves them unmeasured. PER remains useful even with incomplete data, as high-impact actions can still be identified. Frenz provided an example: eliminating 5 TTPs across 1000 assets (5000 attack paths) yields greater risk reduction than removing 1 TTP across the same assets (1000 attack paths).

Graph Theory and List Curation

Graph theory underpins the PER calculation, detailed in the PER 1.0 specification. Current verification relies on two assessors independently arriving at the same metric. Before removing components, Frenz recommends an analytics phase to distinguish essential functionality from unnecessary attack vectors.

Legitimate Business Needs vs. Attack Vectors

The goal is not to eradicate all paths—some serve legitimate business needs—but to eliminate or restrict those with no operational value. For instance, analytics might reveal that browsers rarely require PowerShell execution.

Insurance and Regulatory Implications

Security metrics that reach insurers and regulators become compliance benchmarks, often leading to optimization efforts. PER is designed as a binary measure to prevent manipulation. The calculation confirms whether a path exists or has been eliminated, requiring validation that exploitation is no longer feasible.

Unweighted Structure and Compliance

No subjective assessments or detection-based credits are allowed. The unweighted structure prevents risk reduction through asset reclassification. The nine lists and PER specification are available on GitHub.

About Author

Anuj

See author's posts