Estimating Software Vulnerability Counts in the Context of Cyber Risk Assessments

Date
2018-01-03
Authors
Llanso, Thomas
McNeil, Martha
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Stakeholders often conduct cyber risk assessments as a first step towards understanding and managing their risks due to cyber use. Many risk assessment methods in use today include some form of vulnerability analysis. Building on prior research and combining data from several sources, this paper develops and applies a metric to estimate the proportion of latent vulnerabilities to total vulnerabilities in a software system and applies the metric to five scenarios involving software on the scale of operating systems. The findings suggest caution in interpreting the results of cyber risk methodologies that depend on enumerating known software vulnerabilities because the number of unknown vulnerabilities in large-scale software tends to exceed known vulnerabilities.
Description
Keywords
Cyber Security and Software Assurance, cyber, discovery rate, flaw rate, risk, vulnerability
Citation
Rights
Access Rights
Email libraryada-l@lists.hawaii.edu if you need this content in ADA-compliant format.