OWASP’s subtractive security project measures the attack paths you erased
An attacker who talks a user into opening an attachment gets whatever that machine still permits: a service account with rights across the domain, an outbound route to anywhere, a scripting engine sitting there for the taking. Christopher Frenz wants those capabilities deleted before anyone writes a detection rule for them.
Frenz leads the OWASP Subtractive Security Top 10, a set of nine lists published alongside an engineering standard called Path Erasure Rate. Organizations that answered the last decade by stacking EDR, SIEM, and NDR now pay for alerts on paths they could have removed. The lists name which paths to remove, by platform.
The suite covers Windows, Linux, macOS, Active Directory, AWS, M365, network, and IoT, with a universal list of foundational principles underneath them.
The ordering came from outside security
Frenz took the ranking from a discipline that has been doing this longer.
“In reliability engineering, failure modes are addressed via architectural erasure wherever possible, architectural constraint where erasure is not possible, and monitoring only in cases where erasure and constraint are not possible. In cybersecurity, the attack path is the equivalent of a failure mode. The Hierarchy of Efficacy in the project thus seeks to mimic the failure mode elimination hierarchy used in every other mature engineering discipline by eliminating attack path as a primary defense mechanism, constraining the attack paths that cannot be fully eliminated, and monitoring what cannot be erased or constrained.”
Alert fatigue is one of the conditions the project names as evidence that the additive model has run its course.
“Application of this hierarchy actually improves an organizations ability to detect an attack because it greatly improves the signal to noise ratio in generated alerts as pathways that have been erased no longer contribute to alert noise,” Frenz told Help Net Security.
The EDR contract question
A hierarchy that puts monitoring at the bottom can show up in a budget meeting as an argument to let an endpoint detection renewal lapse.
“The standard does not argue for the elimination of detection and response, but rather that detection and response should not be the primary defense mechanism. Security teams today spend most of their focus on trying to install more effective smoke detectors and becoming a more responsive fire department. The standard argues that while a fire department will always have an essential role, putting out fires should not be the primary focus. The primary focus should be on reducing flammability and architecting a building that cannot easily burn down in the first place.”
The denominator is whoever counted
PER is a fraction: paths erased over paths eligible for erasure. The assessor produces the denominator by enumerating what they can find, so two teams sizing the same estate arrive at different totals.
“Because PER is calculated within a defined operational scope (e.g., an entire Active Directory forest or cloud tenant), narrowing the denominator simply reduces the scope of verified coverage—it doesn’t fake security. Gaming the metric by excluding critical assets doesn’t make those uncounted paths vanish; it just leaves unmeasured risk. Furthermore, PER does not require 100% accuracy in order to be directionally useful and the highest impact actions can still be identified in the absence of perfect data.”
Frenz worked an example.
“If path erasure A eliminates 5 TTPs across 1000 assets (5000 attack paths) and path erasure B eliminates 1 TTP across the same 1000 assets (1000 attack paths) in the organization it is readily apparent that action A will result in a greater reduction in attacker optionality and should be prioritized. The directionality of the impact doesn’t change even if the one person used 998 assets in the count and another team thought there were 1001 assets.”
Reproducing a score
The calculation uses graph theory, and the method sits in the PER 1.0 specification. Verification currently depends on two assessors reading that document and arriving at the same number.
Deleting things breaks things
Frenz puts an analytics phase in front of any removal.
“This approach requires teams take time to learn what functionality is legitimately needed by the environment and what functionality serves no purpose other than keeping attack paths alive. The goal is not to eliminate every possible attack path as some paths do serve legitimate business purposes. The goal is to eliminate or constrain the paths that serve no legitimate purpose. For example, it is likely that a bit of analytics will reveal that your browser never has a legitimate need to launch PowerShell.”
How an item lands on a list
The original OWASP Top 10 draws on a contributed dataset of weaknesses found in real applications. Frenz assembled these lists on a different basis.
“The items on each list are selected based on the reductions of attacker optionality they provide in a typical organization. The lists represent the classes of attack paths whose elimination would result in the largest PER deltas in a typical organization.”
If insurers pick it up
Security scores that reach insurers and regulators become compliance numbers, and compliance numbers get optimized.
“PER is binary to help combat this. In the PER calculation either a path exists or it does not, where does not requires validation that an attack leveraging that path can no longer execute. There is no subjectivity allowed or bonus points for a detection triggering. Moreover, the PER calculation is intentionally unweighted to make it less gameable so risk cannot be reduced on paper by recategorizing assets.”
The unweighted design has a specific target.
“An attacker doesn’t care that the workstation they gained a foothold on after a successful phish is not rated as a critical asset in the risk register.”
The nine lists and the PER specification are live on GitHub.
Download: The ultimate guide to network operations management