Sciweavers

HICSS
2012
IEEE

Effort Estimates for Vulnerability Discovery Projects

11 years 11 months ago
Effort Estimates for Vulnerability Discovery Projects
Security vulnerabilities continue to be an issue in the software field and new severe vulnerabilities are discovered in software products each month. This paper analyzes estimates from domain experts on the amount of effort required for a penetration tester to find a zero-day vulnerability in a software product. Estimates are developed using Cooke's classical method for 16 types of vulnerability discovery projects – each corresponding to a configuration of four security measures. The estimates indicate that, regardless of project type, two weeks of testing are enough to discover a software vulnerability of high severity with fifty percent chance. In some project types an eight-to-five-week is enough to find a zeroday vulnerability with 95 percent probability. While all studied measures increase the effort required for the penetration tester none of them have a striking impact on the effort required to find a vulnerability.
Teodor Sommestad, Hannes Holm, Mathias Ekstedt
Added 21 Apr 2012
Updated 21 Apr 2012
Type Journal
Year 2012
Where HICSS
Authors Teodor Sommestad, Hannes Holm, Mathias Ekstedt
Comments (0)