Attack Surface Measurement: A Weird Machines Perspective

Provided the number of research papers using the term "attack surface" the amount of practitioner literature, and even the number of software tools aimed at attack surface management, we consider the ideas, lexicon, and measurement of attack surfaces instrumental to academic research and practitioner risk analysis. Evolving the discourse on metrics that help security enclaves in public and private organizations minimize the risk of cyber exploits in a given system could be a significant contribution. And indeed, this has been attempted. However, after over a decade of attack surface metric development, the idea remains subjective, dispersed, and ill-defined. Thus, in this paper, we revive the discourse on attack surface measurement using non-exploitability as a cognitive framing of the theories embodied in the area of weird machines.