Work-in-progress Presentations: On the Idea of Risk And Input Complexity: Embracing Insecurity Using Weird Machines Theory to Measure Attack Surfaces

No ratings

Presented at LangSec Workshop 2024 by

Froylan Maldonado

Matthew Levy

We consider the idea of an attack surface and the ability to measure an attack surface as instrumental to understanding the magnitude of vulnerabilities in applications and systems that are critical to cybersecurity risk assessments in organizations. However, attack surfaces are a surprisingly ill-defined concept in academic literature. Thus, we submit to this workshop that the ideas inherent in LangSec, non-exploitability, and insecurity are promising in providing actuarial level precision in providing a topological understanding of a few key concepts: (1) Attack surfaces, (2) Conceptualizing theoretical applications that have attack surfaces of zero, and (3) Attack surfaces of non-zero orders of magnitude. We propose discussing attack surfaces from a LangSec perspective---as an actual topological surface that can potentially lead to interesting findings.