Economics of Software Vulnerability Disclosure

Authors:
Ashish Arora;Rahul Telang
Affiliations:
Carnegie Mellon University;Carnegie Mellon University
Venue:
IEEE Security and Privacy
Year:
2005

Citing 2
Cited 6

Windows of Vulnerability: A Case Study Analysis

Computer
Is Finding Security Holes a Good Idea?

IEEE Security and Privacy

Vulnerability Disclosure: The Strange Case of Bret McDanel

Information Systems Security
Understanding the Value of Countermeasure Portfolios in Information Systems Security

Journal of Management Information Systems
Software security analysis and assessment model for the web-based applications

Journal of Computational Methods in Sciences and Engineering
Rationally opting for the insecure alternative: Negative externalities and the selection of security controls

CISIS'11 Proceedings of the 4th international conference on Computational intelligence in security for information systems
Software, vendors and reputation: an analysis of the dilemma in creating secure software

INTRUST'10 Proceedings of the Second international conference on Trusted Systems
An economic modelling approach to information security risk management

International Journal of Information Management: The Journal for Information Professionals

Quantified Score

Hi-index	0.00

Visualization

Abstract

Information security breaches frequently exploit software flaws or vulnerabilities, causing significant economic losses. Considerable debate and disagreement exist about how to disclose vulnerabilities to the public. A theoretical framework helps identify the key data elements needed to develop a sensible way of handling vulnerability disclosure. The authors analyzed two data setsývendor response to disclosure and attack data from honeypotsýwhich are useful for understanding how attackers respond to disclosure.