Can I read Familiarity Breeds Contempt: the Honeymoon Effect and the Role of Legacy Code in Zero-day Vulnerabilities on EtoBox?

Familiarity Breeds Contempt: the Honeymoon Effect and the Role of Legacy Code in Zero-day Vulnerabilities by Sandy Clark; Stefan Frei; Matt Blaze; Jonathan Smith is a scholarly article available to read on EtoBox.

What is Familiarity Breeds Contempt: the Honeymoon Effect and the Role of Legacy Code in Zero-day Vulnerabilities about?

Work on security vulnerabilities in software has primarily focused on three points in the software life-cycle: (1) finding and removing software defects, (2) patching or hardening software after vulnerabilities have been discovered, and (3) measuring the rate of vulnerability exploitation. This paper examines an earlier period in the software vulnerability lifecycle, starting from the release date of a version through to the disclosure of the fourth vulnerability, with a particular focus on the time from release until the very first disclosed vulnerability.Analysis of software vulnerability data, including up to a decade of data for several versions of the most popular operating systems, server applications and user applications (both open and closed source), shows that properties extrinsic to the software play a much greater role in the rate of vulnerability discovery than do intrinsic properties such as software quality. This leads us to the observation that (at least in the first phase of a product's existence), software vulnerabilities have different properties from software defects.We show that the length of the period after the release of a software product (or version) and b

Author

Sandy Clark; Stefan Frei; Matt Blaze; Jonathan Smith

Publisher

ACM

Published

2010

Language

EN