Document Version: 1.0.0
Project: OWASP Subtractive Hardening Top 10
Platform: Universal / Platform-Agnostic Security Architecture
Specification Alignment: PER-1.0 (Path Erasure Rate Engineering Standard)
License: Apache License 2.0
The OWASP Universal Subtractive Security Laws Top 10 defines a platform-agnostic architectural model for reducing cyber risk through the elimination of attacker-accessible execution, trust, reachability, credential, privilege, control-plane, and data-flow paths.
Unlike traditional security frameworks that focus primarily on vulnerabilities, signatures, alerts, tooling, or compliance control inventories, Subtractive Security prioritizes the removal of architectural conditions that allow local weaknesses to compose into credential theft, privilege escalation, lateral movement, persistence, exfiltration, operational disruption, or material business impact.
This universal standard is not tied to a single platform, technology stack, operating system, cloud provider, identity system, network architecture, SaaS tenant, or embedded-device environment. Instead, it defines recurring attack-path reduction laws that apply across abstraction layers.
Rather than relying on reactive detection, alert tuning, or continuous monitoring as the primary security mechanism, the objective is to physically remove conductive edges from the system graph.
System Graph:
G = (V,E)
Where:
V = Assets, Identities, Processes, Services, Devices, Workloads, Networks, Applications, Data Stores
E = Execution, Trust, Reachability, Authentication, Authorization, Privilege, Control, or Data-Flow Relationships
Each recommendation within this standard is intentionally selected based on its ability to reduce adversary reachability and improve measurable attack-path reduction through the Path Erasure Rate (PER) Engineering Standard.
PER = P_erased / P_eligible
Where:
P_eligible = Eligible attack paths identified within scope
P_erased = Attack paths rendered non-traversable through architectural deletion
The objective of this standard is not to make attacks easier to detect.
The objective is to make attacks impossible by removing the pathways that enable them.
This universal standard defines platform-agnostic subtractive security laws that can be instantiated within specific technology environments.
Platform-specific standards such as Windows, Linux, macOS, Active Directory, AWS, Microsoft 365, Network, IoT, Kubernetes, CI/CD, Azure, GCP, and AI infrastructure should be understood as implementation guides for these universal laws.
The platform-specific details differ because each environment exposes different implementations of execution, trust, privilege, reachability, credential, control-plane, and data-flow paths.
The underlying architectural laws remain consistent.
Examples:
- Adjacent reachability may appear as workstation-to-workstation SMB on Windows, SSH trust on Linux, inter-VLAN routing in networks, or peer-device discovery in IoT.
- Static credentials may appear as local administrator passwords, IAM access keys, OAuth refresh tokens, default IoT passwords, or embedded API secrets.
- Control-plane exposure may appear as router management interfaces, cloud administrative APIs, SaaS admin roles, device web consoles, or Kubernetes API servers.
- Egress paths may appear as endpoint internet access, DNS tunneling, mail forwarding, cloud NAT, vendor telemetry relays, or arbitrary socket creation.
This standard provides the law-level abstraction. Platform standards provide implementation-level guidance.
The Path Erasure Rate (PER) provides a quantitative measure of structural attack-path reduction.
The Universal Subtractive Security Laws Top 10 provides platform-agnostic engineering guidance for identifying the classes of attack paths whose removal most consistently reduces attacker optionality across system graphs.
Together they establish a repeatable security engineering cycle:
- Identify attack paths.
- Measure attack-path exposure.
- Eliminate attack paths where possible.
- Constrain residual attack paths where necessary.
- Measure resulting reduction.
- Continuously improve architectural resilience.
All recommendations within this standard follow the Subtractive Security Hierarchy of Efficacy.
Remove the attack path completely.
Examples:
- Trust relationship removal
- Credential removal
- Protocol removal
- Reachability removal
- Service removal
- Privilege removal
- Execution pathway removal
Where deletion is not feasible, constrain the path.
Examples:
- Segmentation
- Conditional access
- Permission boundaries
- Authenticated mediation
- Allowlisting
- Platform integrity enforcement
- JIT or least-privilege access
Monitoring is reserved for residual attack paths that cannot be deleted or reasonably constrained.
Examples:
- EDR
- SIEM
- IDS/IPS
- Audit logging
- Behavioral detection
- Alerting
Architectural Deletion > Architectural Constraint > Monitoring
Whenever an attack path can be eliminated, elimination is preferred. If elimination is not feasible, the path should be constrained. Monitoring is reserved for residual paths that cannot be removed or sufficiently constrained.
Entries included within this Top 10 were selected according to their recurring presence across multiple platform-specific standards and their ability to:
- Eliminate executable attack-path edges.
- Reduce unnecessary reachability.
- Reduce credential theft opportunities.
- Reduce privilege escalation opportunities.
- Reduce lateral movement pathways.
- Reduce transitive trust and delegation pathways.
- Reduce exfiltration and command-and-control pathways.
- Reduce attack-path composability.
- Improve measurable Path Erasure Rate (PER).
Recommendations are not ranked based on:
- CVSS scores
- Vulnerability prevalence
- Compliance requirements
- Detection coverage
- Vendor capability claims
- Platform popularity
The primary selection criterion is architectural impact through attack-path reduction.
| ID | Title |
|---|---|
| U01 | Adjacent Reachability & Lateral Conductive Edge Erasure |
| U02 | Static & Persistent Credential Elimination |
| U03 | Cleartext & Unauthenticated Control Plane Extinction |
| U04 | Unconstrained Egress & Exfiltration Path Erasure |
| U05 | Management & Diagnostic Interface Surface Reduction |
| U06 | Cross-Domain & Heterogeneous Trust Severing |
| U07 | Execution Scope & Privilege Surface Pruning |
| U08 | Implicit Trust & Transitive Delegation Elimination |
| U09 | Integrity & Boot-Chain Verification Enforcement |
| U10 | Dynamic Protocol & Automatic Discovery Surface Deletion |
Default peer-to-peer communication, broadcast domains, same-subnet reachability, cross-workload access, and unmediated adjacency create conductive paths that allow compromise to propagate across systems.
Eliminate unnecessary adjacent reachability and lateral movement paths.
Compromised Node
↓
Adjacent Reachability
↓
Additional Node
Remove unnecessary peer-to-peer, broadcast, workload-to-workload, and lateral communication pathways.
- Remove default peer-to-peer communication paths.
- Eliminate unnecessary host-to-host reachability.
- Collapse unnecessary broadcast domains.
- Restrict cross-workload movement.
- Remove lateral administrative transit paths.
- Enforce explicit communication boundaries.
Long-lived credentials, hardcoded secrets, default passwords, persistent service tokens, static API keys, and reusable shared secrets create durable attack paths that survive compromise, replay, and theft.
Eliminate static and persistent authentication material wherever possible.
Attacker
↓
Static / Persistent Credential
↓
System Access
Remove reusable credentials that provide durable, transferable, or replayable access.
- Remove hardcoded secrets.
- Eliminate default passwords.
- Remove long-lived API keys.
- Replace static service tokens with short-lived credentials.
- Remove unused credential material.
- Prefer hardware-backed or ephemeral authentication where feasible.
Cleartext listeners, unauthenticated APIs, legacy management protocols, weak RPC paths, and unauthenticated control-plane interfaces create direct paths to interception, replay, unauthorized control, and privilege escalation.
Eliminate cleartext and unauthenticated control-plane access.
Attacker
↓
Cleartext / Unauthenticated Control Path
↓
System Control
Remove unauthenticated or weakly authenticated control-plane pathways.
- Remove cleartext management protocols.
- Disable unauthenticated APIs.
- Remove legacy RPC paths.
- Require authenticated control-plane access.
- Remove weak administrative listeners.
- Replace unauthenticated protocols with verified, authenticated mechanisms.
Implicit outbound routing, arbitrary DNS access, unrestricted socket creation, broad telemetry relays, and unconstrained internet egress allow compromised systems to establish command-and-control, exfiltrate data, or communicate with attacker-controlled infrastructure.
Eliminate arbitrary outbound communication and exfiltration pathways.
Compromised Asset
↓
Unconstrained Egress
↓
External Attacker-Controlled Destination
Restrict outbound communication to deterministic, approved, and necessary destinations.
- Remove implicit 0.0.0.0/0 outbound routing where feasible.
- Restrict arbitrary DNS and socket creation.
- Eliminate unauthorized telemetry relays.
- Enforce explicit egress allowlists.
- Route outbound traffic through controlled mediation points.
- Remove unnecessary external communication paths.
Administrative consoles, diagnostic endpoints, debug ports, maintenance interfaces, management APIs, and support backdoors provide direct pathways to system control.
Reduce exposed management and diagnostic surfaces.
Attacker
↓
Management / Diagnostic Interface
↓
Administrative Control
Remove or isolate administrative, diagnostic, and maintenance interfaces from production attack paths.
- Disable unnecessary administrative consoles.
- Remove exposed debug interfaces.
- Isolate maintenance endpoints.
- Restrict management APIs.
- Remove unused diagnostic services.
- Physically isolate management planes where feasible.
Direct trust relationships and unmediated routing between environments with different risk profiles allow compromise to propagate across architectural boundaries.
Eliminate direct trust and routing paths between heterogeneous domains.
Lower-Trust Domain
↓
Direct Trust / Routing Path
↓
Higher-Impact Domain
Sever unmediated paths between environments with differing trust, sensitivity, ownership, or operational risk.
- Remove direct IT-to-OT routing.
- Separate production and development trust boundaries.
- Restrict guest-to-corporate reachability.
- Remove unnecessary cloud-to-on-premises trust.
- Mediate cross-domain access through controlled gateways.
- Eliminate direct trust between incompatible risk zones.
Unnecessary runtimes, interpreters, binaries, administrative rights, peripheral access, service roles, and execution pathways increase the number of ways attackers can convert access into control.
Reduce the amount of executable and privileged functionality available to attackers.
Compromised Context
↓
Unnecessary Execution / Privilege Surface
↓
Privilege Expansion or Code Execution
Remove unnecessary software, execution scopes, administrative rights, peripheral privileges, and over-privileged service roles.
- Remove unnecessary runtimes and interpreters.
- Remove unused binaries and services.
- Minimize administrative rights.
- Remove unnecessary peripheral access.
- Reduce over-privileged service accounts.
- Remove shell or scripting pathways where unnecessary.
Automatic trust inheritance, wildcard permissions, broad delegation, unconstrained impersonation, and cross-tenant or cross-domain trust create hidden paths through which compromise can propagate beyond the initially affected system.
Eliminate implicit or transitive trust pathways.
Compromised Principal
↓
Implicit Trust / Delegation
↓
Additional Privilege or Data Access
Remove trust relationships that allow privilege, identity, or access to propagate automatically.
- Remove wildcard permissions.
- Remove unconstrained delegation.
- Remove broad service impersonation.
- Reduce cross-tenant trust.
- Remove automatic trust inheritance.
- Enforce explicit trust boundaries.
Unsigned, unverified, or unauthenticated code, firmware, payloads, containers, images, packages, or updates create paths for attackers to introduce executable content below, within, or adjacent to trusted runtime environments.
Eliminate execution of unverified or unauthenticated code and updates.
Unverified Code / Update
↓
Trusted Execution Context
↓
Persistent or Privileged Compromise
Prevent unverified execution at the firmware, boot-chain, operating-system, package, container, application, or update layer.
- Enforce secure boot.
- Require signed firmware.
- Require signed packages or images.
- Remove unsigned update pathways.
- Enforce application or workload integrity.
- Remove unauthenticated code-loading paths.
Dynamic negotiation, automatic discovery, broadcast advertisement, convenience protocols, and unauthenticated peer discovery create unintended trust, topology exposure, lateral movement, and spoofing opportunities.
Eliminate unnecessary dynamic discovery and auto-negotiation pathways.
Asset
↓
Dynamic Discovery / Auto-Negotiation
↓
Unintended Trust or Reachability
Remove dynamic, automatic, or unauthenticated discovery mechanisms that create unnecessary trust or reachability.
- Disable unnecessary broadcast discovery.
- Disable auto-negotiation where unsafe.
- Remove unauthenticated peer advertisement.
- Remove convenience protocols where unnecessary.
- Reduce topology disclosure.
- Remove automatic trust establishment mechanisms.
Identify all eligible attack paths within the declared scope.
P_eligible(t0)
Apply U01 through U10 directly or through relevant platform-specific implementation standards.
Identify attack paths rendered non-traversable.
P_erased(t1)
PER(t1) = P_erased(t1) / P_eligible(t1)
The objective is not improved visibility.
The objective is measurable reduction in reachable attack-path availability.
The Universal Subtractive Security Laws are intended to be composed with platform-specific standards.
Modern enterprise systems are composed of multiple interacting layers. A single business service may include endpoints, servers, cloud workloads, SaaS applications, identity systems, network paths, embedded devices, and third-party integrations.
Attack paths do not respect architectural boundaries.
A compromised endpoint may leverage identity paths. A compromised identity may leverage SaaS or cloud paths. A compromised workload may leverage network or egress paths. A compromised IoT device may leverage enterprise reachability paths.
For this reason, organizations should apply subtractive controls concurrently across all relevant layers.
Examples:
- Windows + Active Directory + Network
- Linux + AWS + Network
- Microsoft 365 + Identity + Endpoint
- IoT + Network + Vendor Trust
- CI/CD + Cloud + Identity
The objective is not to harden individual components in isolation.
The objective is to reduce total attack-path conductivity across the system as a whole.
Subtractive Security recognizes that all controls, including subtractive controls, may fail due to misconfiguration, implementation error, operational drift, software defects, incomplete deployment, or changing business requirements.
For this reason, organizations should seek to eliminate or constrain critical attack paths across multiple independent architectural layers.
This approach provides defense in depth through layered path erasure. If a control fails at one layer, independently implemented attack-path reductions at other layers continue to prevent adversary progression.
Traditional defense in depth often layers monitoring around a path that remains open.
Subtractive defense in depth independently removes or constrains the same path at multiple locations in the architecture.
The objective is not perfect controls.
The objective is resilient non-conductivity.
The goal of these subtractions is to establish deterministic boundaries across the enterprise system graph.
By collapsing attack paths, the environment becomes architecturally non-conductive.
In this model:
Vulnerability = Spark
Attack Path = Oxygen
System Architecture = Conductivity
Remove the path, and the spark goes nowhere.
Attackers can only traverse paths that exist.
The objective of Subtractive Security is to systematically eliminate or constrain those paths until adversary activity can no longer compose into material business impact.
Security effectiveness is maximized when attack paths are removed, not merely observed.
- OWASP Subtractive Hardening Top 10 Project (OWASP Project Repository)
- Path Erasure Rate (PER-1.0) Engineering Standard (PER-1.0 Engineering Specification)
- Evidence-Based Security (Evidence-Based Security Article)
- The Law of Subtractive Risk (The Law of Subtractive Risk)
- The Science of Silence
OWASP Universal Subtractive Security Laws Top 10 v1.0