Is finding security holes a good idea?
Author:
- E. RescorlaERE. Rescorla
Top Cited Papers
- 14 February 2005
- journal article
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Security & Privacy
- Vol. 3 (1) , 14-19
Abstract
Despite the large amount of effort that goes toward finding and patching security holes, the available data does not show a clear improvement in software quality as a result. This article aims to measure the effect of vulnerability finding. Any attempt to measure this kind of effect is inherently rough, depending as it does on imperfect data and several simplifying assumptions. Because I'm looking for evidence of usefulness, where possible, I bias such assumptions in favor of a positive result - explicitly calling out those assumptions biased in the opposite direction. Thus, the analysis in this article represents the best-case scenario, consistent with the data and my ability to analyze it, for the vulnerability finding's usefulnessKeywords
This publication has 4 references indexed in Scilit:
- Is finding security holes a good idea?IEEE Security & Privacy, 2005
- An empirical study of operating systems errors2001
- Time-Dependent Error-Detection Rate Model for Software Reliability and Other Performance MeasuresIEEE Transactions on Reliability, 1979
- The Statistical Analysis of Series of Events1966