An Attack Surface Metric

TLDR

Software security measurement has long been a challenge, yet practical metrics are increasingly essential as demand for secure software grows. The authors propose using a software system’s attack surface measurement as an indicator of its security. They formalize the attack surface concept, introduce a language‑agnostic metric, and validate it through three exploratory studies on small desktop and large enterprise C and Java systems. The metric enables developers to mitigate security risk by measuring and reducing attack surfaces, complements traditional code‑quality improvements, and has been applied in practice through a collaboration with SAP.

Abstract

Measurement of software security is a long-standing challenge to the research community. At the same time, practical security metrics and measurements are essential for secure software development. Hence, the need for metrics is more pressing now due to a growing demand for secure software. In this paper, we propose using a software system's attack surface measurement as an indicator of the system's security. We formalize the notion of a system's attack surface and introduce an attack surface metric to measure the attack surface in a systematic manner. Our measurement method is agnostic to a software system's implementation language and is applicable to systems of all sizes; we demonstrate our method by measuring the attack surfaces of small desktop applications and large enterprise systems implemented in C and Java. We conducted three exploratory empirical studies to validate our method. Software developers can mitigate their software's security risk by measuring and reducing their software's attack surfaces. Our attack surface reduction approach complements the software industry's traditional code quality improvement approach for security risk mitigation and is useful in multiple phases of the software development lifecycle. Our collaboration with SAP demonstrates the use of our metric in the software development process.