Effort estimates for vulnerability discovery projects
2012 (English)In: Proceedings of the 45th Hawaii International Conference on System Sciences, 2012, 5564-5573 p.Conference paper (Refereed)
Security vulnerabilities continue to be an issue in the software field and new severe vulnerabilities are discovered in software products each month. This paper analyzes estimates from domain experts on the amount of effort required for a penetration tester to find a zero-day vulnerability in a software product. Estimates are developed using Cooke's classical method for 16 types of vulnerability discovery projects – each corresponding to a configuration of four security measures. The estimates indicate that, regardless of project type, two weeks of testing are enough to discover a software vulnerability of high severity with fifty percent chance. In some project types an eight-to-five-week is enough to find a zero-day vulnerability with 95 percent probability. While all studied measures increase the effort required for the penetration tester none of them have a striking impact on the effort required to find a vulnerability.
Place, publisher, year, edition, pages
2012. 5564-5573 p.
, Proceedings of the Annual Hawaii International Conference on System Sciences, ISSN 1530-1605
Electrical Engineering, Electronic Engineering, Information Engineering
IdentifiersURN: urn:nbn:se:kth:diva-79614DOI: 10.1109/HICSS.2012.238ScopusID: 2-s2.0-84857973207ISBN: 978-076954525-7OAI: oai:DiVA.org:kth-79614DiVA: diva2:495619
45th Hawaii International Conference on System Sciences, January 4-7 2012,Grand Wailea, Maui
QC 201210182013-03-262012-02-092014-09-08Bibliographically approved