Determining relative attack surface
View Patent ↗The relative attack surface quotient is computed for products to determine their relative susceptibility to attack. The relative attack surface can be calculated by identifying known avenues of attack that correspond to the product and by determining bias values that should be applied to the avenues of attack based upon desired criteria, including, the potential damage that can be caused by an attack. The appropriate bias is applied to each avenue of attack and the resulting bias-applied values are combined into a single relative attack surface quotient. The relative attack surface can be determined prior to or during utilization of a product. The product may include software, computing devices and networks. Upon determining a relative attack surface is too high, utilization of the product can be restricted.
1. A method for determining a relative susceptibility of a computing product to attack, the method comprising:
an act of identifying one or more avenues of attack that correspond to a computing product, each avenue of attack including a way the product can be attacked;
an act of determining a bias value for each identified avenues of attack, the bias value based upon an objective measure of the potential damage that can be caused by each identified avenue of attack, a higher bias value representing a greater potential damage; and
an act of calculating an attack surface quotient for the computing product, the act of calculating comprising:
for each identified avenue of attack, an act of applying the bias value that corresponds to the identified avenue of attack, the act of applying the bias value including an act of multiplying the bias value and the corresponding identified avenue of attack to obtain a resulting bias-applied value; and
combining the resulting bias-applied values by summing all the resulting bias-applied values for each identified avenue of attack.
2. A method as recited in claim 1 , further including an act of comparing the relative attack surface quotient value with a relative attack surface quotient value of another product.
3. A method as recited in claim 1 , further including an act of comparing the relative attack surface quotient value with a prescribed limit.
4. A method as recited in claim 1 , further including an act of publishing the relative attack surface quotient to at least one other device.
5. A method as recited in claim 1 , wherein the act of identifying one or more avenues of attack includes the computing system identifying the one or more avenues of attack from a third party.
6. A method as recited in claim 1 , wherein the product comprises a software application.
7. A method as recited in claim 1 , wherein the product comprises one of a computing system and a network.
8. A computer program product for use in a computing system that is configured to install a computing product, the computer program product including one or more computer-readable storage media having encoded thereon computer-executable instructions for implementing a method for determining a relative susceptibility of the computing product to attack on the computing system, the method comprising the method recited in claim 1 .
9. A computer program product as recited in claim 8 , further including an act of comparing the relative attack surface quotient value with a relative attack surface quotient value of another product.
10. A computer program product as recited in claim 8 , further including an act of comparing the relative attack surface quotient value with a prescribed limit.
11. A computer program product as recited in claim 8 , wherein the act of identifying one or more avenues of attack includes the computing system determining one or more potential avenues of attack.
12. A computer program product as recited in claim 8 , wherein the act of identifying one or more avenues of attack includes the computing system identifying the one or more avenues of attack from a third party.
13. A computer program product as recited in claim 8 , wherein the product comprises a software application.
14. A computer program product as recited in claim 8 , wherein the product comprises one of a computing system and a network.
15. In a network comprising one or more computing systems, a method for determining a relative susceptibility of a computing product to attack and for determining whether to allow utilization of the computing product, the method comprising:
an act of identifying one or more avenues of attack that correspond to the computing product, each avenue of attack including a way the product can be attacked;
an act of determining a bias value for each identified avenue of attack, the bias value based upon an objective measure of the potential damage that can be caused by each identified avenue of attack, a higher bias value representing a greater potential damage;
an act of calculating an attack surface quotient for the computing product, the act of calculating comprising:
for each identified avenue of attack, an act of applying the bias value that corresponds to the identified avenue of attack, the act of applying the bias value including an act of multiplying the bias value and the corresponding identified avenue of attack to obtain a resulting bias-applied value; and
combining the resulting bias-applied values by summing all the resulting bias-applied values for each identified avenue of attack; and
an act of
upon determining that the relative attack surface quotient for the product is within an acceptable range, permitting the product to be utilized at the computing system, or
upon determining that the relative attack surface quotient for any of the one or more products is outside an acceptable range, restricting use of the one or more products at the one or more computing systems.
16. A method as recited in claim 15 , wherein the act of identifying one or more avenues of attack includes the computing system identifying the one or more avenues of attack from information provided by a third party.
17. A method as recited in claim 15 , wherein the product comprises a software application.