The economics of finding and fixing vulnerabilities in distributed systems

ABSTRACT

Robert Morris Sr. has noted that "security and especially cryptography are essentially economic issues." This talk describes the tradeoff analysis that occurs on a daily basis in enterprise information security and software development groups: what bugs and flaws are uncovered, what security capabilities exist, and what is-in fact-the response to security problems. We will explore the patterns that emerge to see where the software security industry is going and why.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.9 Management
          Subjects: Life cycle

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.8 Metrics
          Subjects: Product metrics

General Terms:
Design, Economics, Management, Measurement, Reliability, Security, Verification

Keywords:
managing security