new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

attack-surface/methodology

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Attack Surface Analysis objectives and benefits

Attack Surface Analysis helps identify: (1) what functions and parts of the system need security review and testing for vulnerabilities; (2) high risk code areas that require defense-in-depth protection; (3) when the attack surface has changed and what threat assessment is needed. Attack Surface Analysis is about mapping out what parts of a system need security review and noticing when and how the Attack Surface changes.

Attack Surface categorization and bucketing approach

Group each type of attack point into buckets based on: risk level (external-facing or internal-facing), purpose, implementation, design and technology. Count the number of attack points of each type, choose cases for each type, and focus review on those cases. This approach allows understanding the Attack Surface without needing to understand every endpoint, enabling risk profile assessment at scale.

Attack surface analysis using collected architecture data

To enumerate microservices endpoints that need security testing and threat modeling analysis, analyze data collected on API definition from application-functionality services and service documentation from infrastructure services. This maps to OWASP ASVS V1 #1.1.2 and OWASP Attack Surface Analysis Cheat Sheet.

Give your agent this brain