An Approach to Measuring a System's Attack Surface

摘要: Abstract : Practical software security measurements and metrics are critical to the improvement of security. We propose a metric determine whether one system is more secure than another similar with respect their attack surface. use system's surface measurement as an indicator security; larger surface, insecure system. measure in terms three kinds resources used attacks on system: methods, channels, data. demonstrate our by measuring surfaces two open source IMAP servers FTP daemons. validated conducting expert user survey performing statistical analysis Microsoft Security Bulletins. Our can be tool developers development process consumers decision making process.