Familiarity breeds contempt

Abstract

Work on security vulnerabilities in software has primarily focused on three points in the software life-cycle: (1) finding and removing software defects, (2) patching or hardening software after vulnerabilities have been discovered, and (3) measuring the rate of vulnerability exploitation. This paper examines an earlier period in the software vulnerability lifecycle, starting from the release date of a version through to the disclosure of the fourth vulnerability, with a particular focus on the time from release until the very first disclosed vulnerability.Analysis of software vulnerability data, including up to a decade of data for several versions of the most popular operating systems, server applications and user applications (both open and closed source), shows that properties extrinsic to the software play a much greater role in the rate of vulnerability discovery than do intrinsic properties such as software quality. This leads us to the observation that (at least in the first phase of a product's existence), software vulnerabilities have different properties from software defects.We show that the length of the period after the release of a software product (or version) and before the discovery of the first vulnerability (the 'Honeymoon' period) is primarily a function of familiarity with the system. In addition, we demonstrate that legacy code resulting from code re-use is a major contributor to both the rate of vulnerability discovery and the numbers of vulnerabilities found; this has significant implications for software engineering principles and practice.

The Heavy Tails of Vulnerability Exploitation

“…Frei et al [12] showed that exploits are often quicker to arrive than patches are. An analysis of the same flavour is provided by [27] and [7]. Other studies focused on the modeling of the vulnerability discovery processes.…”

“…Current vulnerability discovery models are however not general enough to represent trends for all software [21]. Moreover, vulnerability disclosure and discovery are complex processes [7,22], and can be influenced by {black/white}-hat community activities [7] and economics [17]. The different risk levels coming from different vulnerability types and exploit sources is outlined in [4].…”

Managing Risk and Information Security

“…There are also external reasons for this trend. Recently, researchers at the University of Pennsylvania analyzed the rate at which vulnerabilities were discovered following 700 major software releases (Clark et al 2010). They found that, in most cases, there was a honeymoon period, averaging about 110 days, during which time relatively few vulnerabilities appeared.…”

Can Cybersecurity Be Proactive? A Big Data Approach and Challenges

“…To be proactive, organizations must take security assurance steps after a software product has been released, but before the broad hacker community discovers its vulnerabilities [7].…”

“…Our definition of Germination Period includes the previously identified "Honeymoon period", which occurs after the release of a system, but before the identification of its first vulnerability [7]. Both of these periods represent opportunities where proactive counter-measures can be advantageously taken.…”