Empirical estimates and observations of 0Day vulnerabilities

Proceedings of the 42nd Annual Hawaii International Conference on System Sciences, HICSS

Volumn , Issue , 2009, Pages

  McQueen, Miles A ^a   McQueen, Trevor A ^b   Boyer, Wayne F ^a   Chaffin, May R ^a  

^a IDAHO NATIONAL LABORATORY   (United States)

^b HARVEY MUDD COLLEGE   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

DEPLOYED SOFTWARES; EMPIRICAL ESTIMATES; LIFE SPANS; PUBLIC DISCLOSURES;

RISK ASSESSMENT;

RISK PERCEPTION;

EID: 78650423222     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2009.186     Document Type: Conference Paper

References (12)

1. National Infrastructure Protection Plan, June 30 2006.
2. A. Ozment,"Improving Vulnerability Discovery Models", ACM Workshop on Quality of Protection, Alexandria, Virginia, October 2007.
3. E. Rescorla, "Is Finding Security Holes a Good Idea", Security & Privacy, IEEE, Jan-Feb 2005, 14-19.
4. A. Ozment,S. Schechter, "Milk or Wine: Does Software Security Improve with Age?", Proceedings of the Fifteenth Usenix Security Symposium. Vancouver, BC, Canada, July 31 - August 4 2006.
5. NIST, National Vulnerability database, http://nvd.nist.gov.
6. H. Cavusoglu, J. Zhang, "Economics of Security Patch Management", The Fifth Workshop in the Economics of Information Security, University of Cambridge, England, June 2006.
7. A. Arora, R. Telang, "Economics of Software Vulnerability Disclosure", Security & Privacy, IEEE, Jan-Feb 2005, 20-25.
8. D, McKinney, "New Hurdles for Vulnerability Disclosure", Security & Privacy, IEEE, March-April, 2008, 76-78.
9. S. Frei, B. Tellenbach, B. Plattner, "0-Day Patch-Exposing Vendors (In)security Performance", BlackHat Europe, Amsterdam, NL, March 2008.
10. P. Mell, K. Scarfone, S. Romanosky, "CVSS- A Complete Guide to the Common Vulnerability Scoring System Version 2.0", On the Forum for Incident Response and Security Team, June 2007.
11. D. Brumley, P. Poosankam, D. Song, J. Zheng, "Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications", Proceedings of the IEEE Security and Privacy Symposium, May, 2008.
12. J. Aitchison, J. Brown, "The Lognormal Distribution", Cambridge University Press, 1957.