Estimating Software Vulnerability Counts in the Context of Cyber Risk Assessments

Simple item page
dc.contributor.authorLlanso, Thomas
dc.contributor.authorMcNeil, Martha
dc.date.accessioned2017-12-28T02:17:42Z
dc.date.available2017-12-28T02:17:42Z
dc.date.issued2018-01-03
dc.description.abstractStakeholders often conduct cyber risk assessments as a first step towards understanding and managing their risks due to cyber use. Many risk assessment methods in use today include some form of vulnerability analysis. Building on prior research and combining data from several sources, this paper develops and applies a metric to estimate the proportion of latent vulnerabilities to total vulnerabilities in a software system and applies the metric to five scenarios involving software on the scale of operating systems. The findings suggest caution in interpreting the results of cyber risk methodologies that depend on enumerating known software vulnerabilities because the number of unknown vulnerabilities in large-scale software tends to exceed known vulnerabilities.
dc.format.extent7 pages
dc.identifier.doi10.24251/HICSS.2018.687
dc.identifier.isbn978-0-9981331-1-9
dc.identifier.urihttp://hdl.handle.net/10125/50576
dc.language.isoeng
dc.relation.ispartofProceedings of the 51st Hawaii International Conference on System Sciences
dc.rightsAttribution-NonCommercial-NoDerivatives 4.0 International
dc.rights.urihttps://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subjectCyber Security and Software Assurance
dc.subjectcyber, discovery rate, flaw rate, risk, vulnerability
dc.titleEstimating Software Vulnerability Counts in the Context of Cyber Risk Assessments
dc.typeConference Paper
dc.type.dcmiText

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
paper0689.pdf
Size:
503.46 KB
Format:
Adobe Portable Document Format
Download

Collections

Cybersecurity and Software Assurance