OWASP Subtractive Security Project: Reducing Attack Surfaces via Capability Removal
The OWASP Subtractive Security Project, led by Christopher Frenz, formalizes a strategic shift from additive security—characterized by increasing detection and monitoring layers—to subtractive security, which focuses on the systematic removal of attack-leveragable capabilities. The framework targets the permanent erasure of high-risk environmental vectors, including over-privileged service accounts, unnecessary outbound routing, and "Living off the Land" (LotL) binaries. By implementing the Path Erasure Rate (PER) engineering standard, organizations can quantitatively measure the elimination of attack paths, effectively limiting lateral movement and reducing the potential blast radius of ransomware and other post-compromise exploitation techniques.