OWASP Releases Subtractive Security Top 10 to Reduce Cyber Risks

Key Takeaways

• The Open Worldwide Application Security Project (OWASP) has launched a new security initiative called the Subtractive Security Top 10.
• This project advocates for a paradigm shift from traditional detection-focused security to actively eliminating potential attack paths.
• It introduces a hierarchy of security controls: architectural deletion, architectural constraint, and finally, monitoring and detection.
• A new metric, Path Erasure Rate (PER), is proposed to quantify the effectiveness of structural security improvements.

OWASP Introduces Subtractive Security: Eliminating Attack Paths to Fortify Defenses

The Open Worldwide Application Security Project (OWASP) has unveiled a novel cybersecurity framework, the Subtractive Security Top 10 Project. This initiative represents a significant pivot in security engineering, emphasizing the systematic removal of attack vectors rather than merely identifying or monitoring them.

For years, cybersecurity strategies have predominantly focused on an additive approach—bolstering defenses by incorporating more security tools, generating additional alerts, enhancing logging, deploying endpoint solutions, and tightening access controls. OWASP’s new project challenges this conventional wisdom by posing a fundamental question to security professionals: what elements can be removed from an environment to inherently make an attack more difficult, or even impossible?

The core philosophy underpinning this project is straightforward: threat actors are limited to exploiting existing pathways. By strategically eliminating superfluous access, unnecessary services, excessive trust relationships, elevated privileges, outdated protocols, and unwarranted network exposure, organizations can drastically reduce the opportunities available to attackers for initial compromise, lateral movement, privilege escalation, and persistence.

The Subtractive Security Hierarchy

On GitHub, OWASP describes this methodology as subtractive security, prioritizing foundational architectural changes that directly remove attack paths. The project structures security controls into a clear hierarchy based on their efficacy in shrinking the enterprise attack surface:

1. Architectural Deletion: This is the most potent form of defense, involving the complete eradication of an attack path. Examples include decommissioning legacy protocols, deactivating unused services, purging dormant user accounts, eliminating public-facing exposure where unnecessary, and revoking excessive administrative privileges.
2. Architectural Constraint: When an attack path cannot be entirely removed due due to business or operational imperatives, this principle applies. It involves limiting exposure through measures such as stringent network segmentation, implementing private endpoints, enforcing conditional access policies, defining permission boundaries, and restricting privileges to the absolute minimum required.
3. Monitoring & Detection: Positioned as the third tier, monitoring and detection tools remain crucial. This includes logging systems, Security Information and Event Management (SIEM) platforms, Endpoint Detection and Response (EDR) solutions, Intrusion Detection Systems (IDS), and alert mechanisms. However, OWASP stresses that detection alone does not eliminate the underlying vulnerability an attacker might exploit.

The guiding principle is clear: Delete > Constrain > Monitor. Removing attack paths is the most effective preventative measure, while monitoring serves as the final line of defense against residual risks.

Architectural Principles for Subtractive Security

The OWASP Subtractive Security Top 10 outlines ten architectural principles designed to guide organizations in implementing this strategy:

• 1. Reduce unnecessary reachability: Eliminate network exposure and access routes not essential for business operations.
• 2. Reduce unnecessary trust relationships: Eradicate excessive cross-system, identity, and service trust dependencies.
• 3. Reduce credential exposure: Limit the availability, reuse, storage, and transmission paths of credentials.
• 4. Reduce privilege propagation: Prevent the spread of administrative rights and permissions across systems and identities.
• 5. Reduce executable attack paths: Remove services, protocols, applications, and configurations that could be exploited by attackers.
• 6. Reduce control-plane exposure: Restrict access to cloud, identity, infrastructure, and management interfaces.
• 7. Reduce attack-surface area: Decommission unused software, ports, accounts, APIs, and legacy components.
• 8. Enforce deterministic communications: Permit only explicitly required inbound, outbound, and east-west traffic flows.
• 9. Constrain residual attack paths: Implement segmentation, private endpoints, conditional access, and permission boundaries where complete removal is impractical.
• 10. Measure structural improvement through PER: Utilize the Path Erasure Rate (PER) to quantify eligible attack paths that have been structurally removed.

Measuring Security Improvements with Path Erasure Rate (PER)

A significant contribution of this project is the introduction of the Path Erasure Rate (PER) as a quantifiable metric for assessing security enhancements. PER measures the proportion of identified attack paths that have been structurally eliminated. Essentially, it quantifies how many potential attacker routes are no longer viable following security interventions.

The formula for PER is expressed as PER = |P_erased| / |P_eligible|, where P_eligible represents all actionable attack paths within a defined scope, and P_erased denotes the subset of those paths that have been successfully eliminated.

OWASP emphasizes that this framework supports a continuous, repeatable process: identify potential attack paths, accurately measure current exposure, actively remove or constrain these paths, quantify the resulting reduction in risk, and consistently refine the architectural security posture.

The Subtractive Security Top 10 provides a universal set of security principles applicable across various technologies. Furthermore, it offers specific guidance tailored to diverse platforms and environments, including Windows, Linux, Active Directory, AWS, Microsoft 365, network infrastructure, Internet of Things (IoT) devices, macOS, applications, data stores, high-performance computing (HPC) environments, CI/CD pipelines, and artificial intelligence (AI) infrastructure.

For example, an organization aiming to mitigate ransomware risk could apply these principles by removing unused local administrator accounts, disabling outdated remote access protocols, restricting east-west network communication, and revoking unnecessary cloud identity permissions. These actions collectively reduce the pathways an attacker could exploit, even if an initial endpoint compromise occurs.

The project also advocates for concurrent implementation across all relevant technology layers. In a cloud environment, this would entail simultaneously applying pertinent AWS, Linux, identity management, network, and CI/CD controls. This holistic approach is critical, as attackers frequently traverse these boundaries after establishing an initial foothold.

The OWASP Subtractive Security Top 10 Project is freely available under the Apache License 2.0. Cybersecurity researchers, architects, cloud engineers, and defenders are encouraged to review, utilize, modify, and contribute to this guidance via its public GitHub repository.

What You Should Do

• Review Your Attack Surface: Conduct a thorough audit of your current infrastructure to identify all potential attack paths, including unnecessary services, dormant accounts, legacy protocols, and excessive trust relationships.
• Prioritize Deletion: Wherever possible, eliminate attack paths entirely by decommissioning unused components and revoking unnecessary access.
• Implement Constraints: For paths that cannot be removed, apply stringent constraints such as network segmentation, least privilege principles, and conditional access policies.
• Measure and Iterate: Utilize the Path Erasure Rate (PER) to quantify your progress in reducing attack paths and continuously refine your security architecture based on these measurements.
• Engage with the Community: Leverage the OWASP Subtractive Security Top 10 guidance and contribute to its ongoing development through the GitHub repository.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.