Feeds

Researchers look to predict software flaws

Vulnerability formula

SANS - Survey on application security programs

Some security experts have doubts whether the model will ever be able to make better than a rough estimate of the number of vulnerabilities that will likely to be found in a particular application.

The prediction of the number of vulnerabilities from general trend data may gloss over too many important details to be of real value, said Gerhard Eschelbeck, chief technology officer for anti-spyware firm Webroot Software.

"This is a little bit like predicting the next earthquake," Eschelbeck said. "It's a valuable area of research but it may not, in the end, be practical."

Because vulnerability researchers' interest in finding flaws in a particular product can be fickle, general trends could be swamped by other variables.

In July, for example, Microsoft's Internet Explorer browser will likely see an uncharacteristically large number of vulnerabilities found because one researcher has decided to release a bug each day of the month. Market forces could also throw off the models, since a handful of companies now pay for previously unknown flaws, a situation that could cause researchers to stay interested in older operating systems.

Moreover, the discovery of less serious flaws is far less important than critical vulnerabilities that could lead to remote compromises, Eschelbeck said.

"It is not just about the number, but about the severity," he said. "Just the pure number does not mean a lot without the context."

If such limitations could be overcome, the ability to predict the future number of software flaws could have big benefits, said Brian Chess, chief scientist with source-code analysis tool maker Fortify. For example, the assumption that vulnerabilities will always be present in software may suggest a better strategy for dealing with the issues. Developers can choose to put their resources into finding the more serious issues, he said.

"If you accept that flaws can't be gotten rid of, you can decide which mistakes you are going to make and which ones are not acceptable," Chess said. "Even though you cannot predict which line of codes will have the vulnerabilities, you can push the actual class of vulnerabilities one way or another."

In the end, even if the research does not produce accurate predictions, accepting that you will have security problems and learning to deal with the aftermath of releasing a software product are important lessons, he said.

"The next thing you build will have security problems just like the last thing you did, but let's make sure that when we have a vulnerability, we can deal with it," Chess said. "I think that is an evolution in the way that people think about building security into their software."

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Top three mobile application threats

More from The Register

next story
Ubuntu 14.04 LTS: Great changes, but sssh don't mention the...
Why HELLO Amazon! You weren't here last time
Next Windows obsolescence panic is 450 days from … NOW!
The clock is ticking louder for Windows Server 2003 R2 users
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.