Microsoft has rewritten its Attack Surface Analyzer tool to take advantage of modern, cross-platform technologies, the company announced this week.
The initial Attack Surface Analyzer 1.0 was released in 2012, designed to help software developers and IT professionals identify modifications that occur in the Windows operating systems during application installations.
The new iteration of the tool, Attack Surface Analyzer 2.0, was built using .NET Core and can now be used on Windows, Linux, and macOS, and has been released as open source on GitHub.
With the help of Attack Surface Analyzer 2.0, developers can identify potential security risks that changes to the operating system’s security configuration may introduce. The tool analyzes the attack surface of a target system and reports on potential vulnerabilities introduced during app installation.
For that, the tool monitors for modifications made to the file system, user accounts, system services, network ports (listeners), system certificate stores, and registry (only on Windows).
“This tool can play an important role in ensuring that the software you develop or deploy doesn’t adversely affect the operating system security configuration by allowing you to scan for specific types of changes,” Microsoft explains.
In the results it delivers after performing the comparison analysis, Attack Surface Analyzer 2.0 highlights relevant changes. Furthermore, the tool allows for these results to be easily viewed or exported.
The updated tool includes both Electron and command line interface options and writes the results for the command line option to a local HTML or JSON file, thus supporting inclusion in automated toolchains.
Microsoft says it is aiming at adding more features to the tool, including code signing info, monitoring of drivers and firewall settings, live monitoring of network traffic and registry, and redistributable installations.
Related: Security Shifts Left to be Part of Software Development Best Practice: Report
Related: How the Secure Development Lifecycle Can Help Protect IIoT Deployments
Related: Google Launches “Asylo” Framework for Confidential Computing
