Attack Surface Analysis Cheat Sheet / 攻击面分析备忘单¶

What is Attack Surface Analysis and Why is it Important / 什么是攻击面分析以及为什么它很重要¶

This article describes a simple and pragmatic way of doing Attack Surface Analysis and managing an application's Attack Surface. It is targeted to be used by developers to understand and manage application security risks as they design and change an application, as well as by application security specialists doing a security risk assessment. The focus here is on protecting an application from external attack - it does not take into account attacks on the users or operators of the system (e.g. malware injection, social engineering attacks), and there is less focus on insider threats, although the principles remain the same. The internal attack surface is likely to be different from the external attack surface and some users may have a lot of access.

本文介绍了一种进行攻击面分析和管理应用程序攻击面的简单实用的方法。它的目标是供开发人员在设计和更改应用程序时用来了解和管理应用程序安全风险，以及供应用程序安全专家进行安全风险评估。这里的重点是保护应用程序免受外部攻击 - 它没有考虑对系统用户或操作员的攻击（例如恶意软件注入、社会工程攻击），并且较少关注内部威胁，尽管原理保持不变。内部攻击面可能与外部攻击面不同，并且某些用户可能拥有大量访问权限。

Attack Surface Analysis is about mapping out what parts of a system need to be reviewed and tested for security vulnerabilities. The point of Attack Surface Analysis is to understand the risk areas in an application, to make developers and security specialists aware of what parts of the application are open to attack, to find ways of minimizing this, and to notice when and how the Attack Surface changes and what this means from a risk perspective.

攻击面分析是为了确定系统的哪些部分需要检查和测试安全漏洞。攻击面分析的目的是了解应用程序中的风险区域，使开发人员和安全专家了解应用程序的哪些部分容易受到攻击，找到最小化攻击面的方法，并注意攻击面何时以及如何变化，以及从风险角度来看这意味着什么。

While Attack Surface Analysis is usually done by security architects and pen testers, developers should understand and monitor the Attack Surface as they design and build and change a system.

虽然攻击面分析通常由安全架构师和渗透测试人员完成，但开发人员在设计、构建和更改系统时应了解和监控攻击面。

Attack Surface Analysis helps you to:

攻击面分析可帮助您：

identify what functions and what parts of the system you need to review/test for security vulnerabilities
中文：确定需要审查/测试哪些功能和系统哪些部分以发现安全漏洞
identify high risk areas of code that require defense-in-depth protection - what parts of the system that you need to defend
中文：识别需要深度防御保护的高风险代码区域 - 您需要保护系统的哪些部分
identify when you have changed the attack surface and need to do some kind of threat assessment
中文：确定何时更改了攻击面并需要进行某种威胁评估

Defining the Attack Surface of an Application / 定义应用程序的攻击面¶

The Attack Surface describes all of the different points where an attacker could get into a system, and where they could get data out.

攻击面描述了攻击者可以进入系统以及可以从何处获取数据的所有不同点。

The Attack Surface of an application is:

应用程序的攻击面是：

the sum of all paths for data/commands into and out of the application, and
中文：数据/命令进入和离开应用程序的所有路径之和，以及
the code that protects these paths (including resource connection and authentication, authorization, activity logging, data validation and encoding)
中文：保护这些路径的代码（包括资源连接和身份验证、授权、活动日志记录、数据验证和编码）
all valuable data used in the application, including secrets and keys, intellectual property, critical business data, personal data and PII, and
中文：应用程序中使用的所有有价值的数据，包括秘密和密钥、知识产权、关键业务数据、个人数据和 PII，以及
the code that protects these data (including encryption and checksums, access auditing, and data integrity and operational security controls).
中文：保护这些数据的代码（包括加密和校验和、访问审核以及数据完整性和操作安全控制）。

You overlay this model with the different types of users - roles, privilege levels - that can access the system (whether authorized or not). Complexity increases with the number of different types of users. It is important to focus on the two extremes: unauthenticated, anonymous users and highly privileged admin users (e.g. database administrators, system administrators).

您可以使用可以访问系统（无论是否授权）的不同类型的用户（角色、权限级别）覆盖此模型。复杂性随着不同类型用户数量的增加而增加。重要的是要关注两个极端：未经身份验证的匿名用户和高特权的管理用户（例如数据库管理员、系统管理员）。

Group each type of attack point into buckets based on risk (external-facing or internal-facing), purpose, implementation, design and technology. Then, count the number of attack points of each type. Next, choose some cases for each type. Finally, focus your review/assessment on those cases.

根据风险（面向外部或面向内部）、目的、实施、设计和技术将每种类型的攻击点分组。然后，统计每种类型的攻击点数。接下来，为每种类型选择一些案例。最后，将审查/评估的重点放在这些案例上。

With this approach, you don't need to understand every endpoint in order to understand the Attack Surface and the potential risk profile of a system. Instead, you can count the different general type of endpoints and the number of points of each type. This enables you to budget what it will take to assess risk at scale, and you can tell when the risk profile of an application has significantly changed.

通过这种方法，您无需了解每个端点即可了解系统的攻击面和潜在风险状况。相反，您可以计算不同一般类型的端点以及每种类型的点数。这使您能够预算大规模评估风险所需的费用，并且您可以判断应用程序的风险状况何时发生显着变化。

Microservice and Cloud Native Applications / 微服务和云原生应用程序¶

Microservice and Cloud Native applications are comprised of multiple smaller components, loosely coupled using APIs and independently scalable. When assessing the attack surface for applications of this architectural style, you should prioritize the components that are reachable from an attack source (e.g. external traffic from the Internet). Such components may be located behind tiers of proxies, load balancers and ingress controllers, and may auto-scale without warning.

微服务和云原生应用程序由多个较小的组件组成，使用 API 松散耦合并可独立扩展。在评估这种架构风格的应用程序的攻击面时，您应该优先考虑可从攻击源访问的组件（例如来自 Internet 的外部流量）。此类组件可能位于代理、负载均衡器和入口控制器层后面，并且可以在没有警告的情况下自动扩展。

Open source tooling such as Cilium Hubble and kubeshark assist in visualizing the attack surface for Kubernetes and service-mesh deployments.

Cilium Hubble 和 kubeshark 等开源工具有助于可视化 Kubernetes 和服务网格部署的攻击面。

Identifying and Mapping the Attack Surface / 识别和映射攻击面¶

You can start building a baseline description of the Attack Surface in a picture and notes. Spend a few hours reviewing design and architecture documents from an attacker's perspective. Read through the source code and identify different points of entry/exit:

您可以开始在图片和注释中构建攻击面的基线描述。花几个小时从攻击者的角度审查设计和架构文档。通读源代码并识别不同的入口/出口点：

User interface (UI) forms and fields
中文：用户界面 (UI) 表单和字段
HTTP headers and cookies
中文：HTTP 标头和 cookie
APIs
中文：蜜蜂
Files
中文：文件
Databases
中文：数据库
Other local storage
中文：其他本地存储
Email or other kinds of messages
中文：电子邮件或其他类型的消息
Runtime arguments
中文：运行时参数
...Your points of entry/exit
中文：...您的入口/出口点

The total number of different attack points can easily add up into the thousands or more. To make this manageable, break the model into different types based on function, design and technology:

不同攻击点的总数很容易就会达到数千甚至更多。为了使其易于管理，请根据功能、设计和技术将模型分为不同类型：

Login/authentication entry points
中文：登录/认证入口点
Admin interfaces
中文：管理界面
Inquiries and search functions
中文：查询及搜索功能
Data entry (CRUD) forms
中文：数据输入 (CRUD) 表格
Business workflows
中文：业务流程
Transactional interfaces/APIs
中文：事务接口/API
Operational command and monitoring interfaces/APIs
中文：操作命令和监控接口/API
Interfaces with other applications/systems
中文：与其他应用程序/系统的接口
...Your types
中文：...你的类型

You also need to identify the valuable data (e.g. confidential, sensitive, regulated) in the application, by interviewing developers and users of the system, and again by reviewing the source code.

您还需要通过采访系统的开发人员和用户并再次检查源代码来识别应用程序中的有价值的数据（例如机密、敏感、受监管）。

You can also build up a picture of the Attack Surface by scanning the application. For web apps you can use a tool like ZAP or another maintained dynamic testing tool to crawl your app and map the parts of the application that are accessible over the web. Some web application firewalls (WAFs) may also be able to export a model of the application's entry points.

您还可以通过扫描应用程序来构建攻击面的图片。对于 Web 应用程序，您可以使用 ZAP 等工具或其他维护的动态测试工具来抓取您的应用程序并映射可通过网络访问的应用程序部分。某些 Web 应用程序防火墙 (WAF) 还可以导出应用程序入口点的模型。

Validate and fill in your understanding of the Attack Surface by walking through some of the main use cases in the system: signing up and creating a user profile, logging in, searching for an item, placing an order, changing an order, and so on. Follow the flow of control and data through the system, see how information is validated and where it is stored, what resources are touched and what other systems are involved. There is a recursive relationship between Attack Surface Analysis and Application Threat Modeling: changes to the Attack Surface should trigger threat modeling, and threat modeling helps you to understand the Attack Surface of the application.

通过演练系统中的一些主要用例来验证并补充您对攻击面的理解：注册和创建用户配置文件、登录、搜索项目、下订单、更改订单等。跟踪系统中的控制和数据流，了解信息如何验证、存储在哪里、涉及哪些资源以及涉及哪些其他系统。攻击面分析和应用程序威胁建模之间存在递归关系：攻击面的更改应该触发威胁建模，威胁建模可以帮助您了解应用程序的攻击面。

The Attack Surface model may be rough and incomplete to start, especially if you haven't done any security work on the application before. Fill in the holes as you dig deeper in a security analysis, or as you work more with the application and realize that your understanding of the Attack Surface has improved.

攻击面模型一开始可能很粗糙且不完整，特别是如果您之前没有对应用程序进行过任何安全工作的话。当您深入安全分析时，或者当您更多地使用应用程序并意识到您对攻击面的理解有所提高时，请填补漏洞。

Measuring and Assessing the Attack Surface / 测量和评估攻击面¶

Once you have a map of the Attack Surface, identify the high risk areas. Focus on remote entry points – interfaces with outside systems and to the Internet – and especially where the system allows anonymous, public access.

获得攻击面地图后，即可识别高风险区域。重点关注远程入口点——与外部系统和互联网的接口——尤其是系统允许匿名、公共访问的地方。

Network-facing, especially internet-facing code
中文：面向网络，尤其是面向互联网的代码
Web forms
中文：网页表格
Files from outside of the network
中文：来自网络外部的文件
Backward compatible interfaces with other systems – old protocols, sometimes old code and libraries, hard to maintain and test multiple versions
中文：与其他系统的向后兼容接口 - 旧协议，有时是旧代码和库，难以维护和测试多个版本
Custom APIs – protocols etc – likely to have mistakes in design and implementation
中文：自定义 API（协议等）可能在设计和实现中出现错误
Security code: anything to do with cryptography, authentication, authorization (access control) and session management
中文：安全代码：与加密、身份验证、授权（访问控制）和会话管理有关的任何内容

These are often where you are most exposed to attack. Then understand what compensating controls you have in place, operational controls like network firewalls and application firewalls, and intrusion detection or prevention systems to help protect your application.

这些通常是您最容易受到攻击的地方。然后了解您拥有哪些补偿控制、网络防火墙和应用程序防火墙等操作控制以及入侵检测或预防系统来帮助保护您的应用程序。

Michael Howard at Microsoft and other researchers have developed a method for measuring the Attack Surface of an application, and to track changes to the Attack Surface over time, called the Relative Attack Surface Quotient (RSQ). Using this method you calculate an overall attack surface score for the system, and measure this score as changes are made to the system and to how it is deployed. Researchers at Carnegie Mellon built on this work to develop a formal way to calculate an Attack Surface Metric for large systems like SAP. They calculate the Attack Surface as the sum of all entry and exit points, channels (the different ways that clients or external systems connect to the system, including TCP/UDP ports, RPC endpoints, named pipes...) and untrusted data elements. Then they apply a damage potential/effort ratio to these Attack Surface elements to identify high-risk areas.

Microsoft 的 Michael Howard 和其他研究人员开发了一种测量应用程序攻击面并跟踪攻击面随时间变化的方法，称为“相对攻击面商数 (RSQ)”(https://www.cs.cmu.edu/~wing/publications/Howard-Wing03.pdf)。使用此方法，您可以计算系统的总体攻击面分数，并在对系统及其部署方式进行更改时衡量此分数。卡内基梅隆大学的研究人员在此工作的基础上开发了一种正式方法来计算 SAP 等大型系统的攻击面指标。他们将攻击面计算为所有入口和出口点、通道（客户端或外部系统连接到系统的不同方式，包括 TCP/UDP 端口、RPC 端点、命名管道...）和不可信数据元素的总和。然后，他们对这些攻击面元素应用潜在损害/努力比率来识别高风险区域。

Note that deploying multiple versions of an application, leaving features in that are no longer used just in case they may be needed in the future, or leaving old backup copies and unused code increases the Attack Surface. Source code control and robust change management/configurations practices should be used to ensure the actual deployed Attack Surface matches the theoretical one as closely as possible.

请注意，部署应用程序的多个版本、保留不再使用的功能以防将来可能需要它们，或者保留旧的备份副本和未使用的代码都会增加攻击面。应使用源代码控制和强大的变更管理/配置实践来确保实际部署的攻击面与理论攻击面尽可能接近。

Backups of code and data - online, and on offline media - are an important but often ignored part of a system's Attack Surface. Protecting your data and IP by writing secure software and hardening the infrastructure will all be wasted if you hand everything over to bad actors by not protecting your backups.

代码和数据的备份（在线和离线媒体）是系统攻击面的一个重要但经常被忽视的部分。如果您不保护备份而将一切交给不良行为者，那么通过编写安全软件和强化基础设施来保护您的数据和 IP 都将被浪费。

Managing the Attack Surface / 管理攻击面¶

Once you have a baseline understanding of the Attack Surface, you can use it to incrementally identify and manage risks going forward as you make changes to the application. Ask yourself:

一旦您对攻击面有了基本了解，您就可以在对应用程序进行更改时使用它来逐步识别和管理未来的风险。问问自己：

What has changed?
中文：发生了什么变化？
What are you doing different? (technology, new approach, ….)
中文：你在做什么不同的事情？（技术、新方法……）
What holes could you have opened?
中文：你能打开什么洞？

The first web page that you create opens up the system's Attack Surface significantly and introduces all kinds of new risks. If you add another field to that page, or another web page like it, while technically you have made the Attack Surface bigger, you haven't increased the risk profile of the application in a meaningful way. Each of these incremental changes is more of the same, unless you follow a new design or use a new framework.

您创建的第一个网页显着打开了系统的攻击面并引入了各种新风险。如果您向该页面或类似的另一个网页添加另一个字段，虽然从技术上讲您已经扩大了攻击面，但您并没有以有意义的方式增加应用程序的风险状况。这些增量更改中的每一个都比较相同，除非您遵循新的设计或使用新的框架。

If you add another web page that follows the same design and using the same technology as existing web pages, it's easy to understand how much security testing and review it needs. If you add a new web services API or file that can be uploaded from the Internet, each of these changes have a different risk profile again - see if the change fits in an existing bucket, see if the existing controls and protections apply. If you're adding something that doesn't fall into an existing bucket, this means that you have to go through a more thorough risk assessment to understand what kind of security holes you may open and what protections you need to put in place.

如果您添加另一个与现有网页遵循相同设计并使用相同技术的网页，则很容易了解它需要多少安全测试和审查。如果您添加新的 Web 服务 API 或可以从 Internet 上传的文件，则每个更改都会再次具有不同的风险状况 - 查看更改是否适合现有存储桶，查看现有的控制和保护是否适用。如果您要添加的内容不属于现有存储桶，这意味着您必须进行更彻底的风险评估，以了解可能会打开哪种安全漏洞以及需要采取哪些保护措施。

Changes to session management, authentication and password management directly affect the Attack Surface and need to be reviewed. So do changes to authorization and access control logic, especially adding or changing role definitions, adding admin users or admin functions with high privileges. Similarly for changes to the code that handles encryption and secrets. Fundamental changes to how data validation is done. And major architectural changes to layering and trust relationships, or fundamental changes in technical architecture – swapping out your web server or database platform, or changing the runtime operating system.

会话管理、身份验证和密码管理的更改直接影响攻击面，需要进行审查。对授权和访问控制逻辑的更改也是如此，特别是添加或更改角色定义、添加具有高权限的管理用户或管理功能。对于处理加密和机密的代码的更改也是如此。对数据验证方式的根本性改变。以及分层和信任关系的重大架构更改，或技术架构的根本性更改 - 更换您的 Web 服务器或数据库平台，或更改运行时操作系统。

As you add new user types or roles or privilege levels, you do the same kind of analysis and risk assessment. Overlay the type of access across the data and functions and look for problems and inconsistencies. It's important to understand the access model for the application, whether it is positive (access is deny by default) or negative (access is allow by default). In a positive access model, any mistakes in defining what data or functions are permitted to a new user type or role are easy to see. In a negative access model, you have to be much more careful to ensure that a user does not get access to data/functions that they should not be permitted to.

当您添加新的用户类型或角色或权限级别时，您可以进行相同类型的分析和风险评估。覆盖数据和功能之间的访问类型，并查找问题和不一致之处。了解应用程序的访问模型非常重要，无论是积极的（默认情况下拒绝访问）还是消极的（默认情况下允许访问）。在积极的访问模型中，在定义新用户类型或角色允许哪些数据或功能时出现的任何错误都很容易看出。在消极访问模型中，您必须更加小心，以确保用户无法访问不应被允许的数据/功能。

This kind of threat or risk assessment can be done periodically, or as a part of design work in serial / phased / spiral / waterfall development projects, or continuously and incrementally in Agile / iterative development.

这种威胁或风险评估可以定期进行，也可以作为串行/分阶段/螺旋/瀑布开发项目中设计工作的一部分，或者在敏捷/迭代开发中持续增量地进行。

Normally, an application's Attack Surface will increase over time as you add more interfaces and user types and integrate with other systems. You also want to look for ways to reduce the size of the Attack Surface when you can by simplifying the model (reducing the number of user levels for example or not storing confidential data that you don't absolutely have to), turning off features and interfaces that aren't being used, by introducing operational controls such as a Web Application Firewall (WAF) and real-time application-specific attack detection.

通常，随着您添加更多界面和用户类型以及与其他系统集成，应用程序的攻击面会随着时间的推移而增加。您还希望寻找方法来减少攻击面的大小，例如简化模型（例如减少用户级别的数量或不存储您绝对不需要的机密数据）、关闭未使用的功能和接口、引入操作控制（例如 Web 应用程序防火墙 (WAF) 和实时特定于应用程序的攻击检测）。

References / 参考¶

Howard, Pincus, and Wing: Measuring Relative Attack Surfaces) （Howard、Pincus 和 Wing：测量相对攻击面）
OWASP: Threat Modeling) （OWASP：威胁建模）