Vulnerability Discovery Process Research Articles

Uji Vulnerability Assessment Dalam Mengetahui Tingkat Keamanan Web Aplikasi Sistem Informasi Laporan Diskominfo Dan Sandi Aceh

Along with the increasing need for information systems in the Districts/Cities of Aceh Province in supporting the development process of a region, the penetration test and evaluation of the system has been delayed. This is due to the limited number of experts in the province as well as the level of dependence on human resources in Districts/Cities who have limited capacity in terms of testing information systems. Therefore, with the presence of the latest web application information system at Diskominfo and Sandi Aceh, it requires system testing to determine the feasibility level of publication of the information system. The testing technique in this study used the VAPT Life Cycle method. Where the VAPT Life Cycle will identify, describe, assess vulnerabilities based on the CVSS (Common Vulnerability Scoring System) and provide solutions for handling vulnerabilities. The vulnerability discovery process in this study uses the Nessus Vulnerability Scanning tool. From the findings there are 4 vulnerabilities, 1 in the high category and 3 in the medium category. This vulnerability data can be used as evaluation material to close or fix existing security holes.

Selecting Best Software Vulnerability Scanner Using Intuitionistic Fuzzy Set TOPSIS

Software developers endeavor to build their products with the least number of bugs. Despite this, many vulnerabilities are detected in software that threatens its integrity. Various automated software i.e., vulnerability scanners, are available in the market which helps detect and manage vulnerabilities in a computer, application, or a network. Hence, the choice of an appropriate vulnerability scanner is crucial to ensure efficient vulnerability management. The current work serves a dual purpose, first, to identify the key factors which affect the vulnerability discovery process in a network. The second, is to rank the popular vulnerability scanners based on the identified attributes. This will aid the firm in determining the best scanner for them considering multiple aspects. The multi-criterion decision making based ranking approach has been discussed using the Intuitionistic Fuzzy set (IFS) and Technique for Order of Preference by Similarity to Ideal Solution (TOPSIS) to rank the various scanners. Using IFS TOPSIS, the opinion of a whole group could be simultaneously considered in the vulnerability scanner selection. In this study, five popular vulnerability scanners, namely, Nessus, Fsecure Radar, Greenbone, Qualys, and Nexpose have been considered. The inputs of industry specialists i.e., people who deal in software security and vulnerability management process have been taken for the ranking process. Using the proposed methodology, a hierarchical classification of the various vulnerability scanners could be achieved. The clear enumeration of the steps allows for easy adaptability of the model to varied situations. This study will help product developers become aware of the needs of the market and design better scanners. And from the user's point of view, it will help the system administrators in deciding which scanner to deploy depending on the company's needs and preferences. The current work is the first to use a Multi Criterion Group Decision Making technique in vulnerability scanner selection.

The Tip of the Iceberg

In this article, we investigate a fundamental question regarding software security: Is the security of SW releases increasing over time? We approach this question with a detailed analysis of the large body of open-source software packaged in the popular Debian GNU/Linux distribution. Contrary to common intuition, we find no clear evidence that the vulnerability rate of widely used software decreases over time: Even in popular and “stable” releases, the fixing of bugs does not seem to reduce the rate of newly identified vulnerabilities. The intuitive conclusion is worrisome: Commonly employed development and validation procedures do not seem to scale with the increase of features and complexity—they are only chopping pieces off the top of an iceberg of vulnerabilities. To the best of our knowledge, this is the first investigation into the problem that studies a complete distribution of software, spanning multiple versions. Although we can not give a definitive answer, we show that several popular beliefs also cannot be confirmed given our dataset. We publish our Debian Vulnerability Analysis Framework (DVAF) , an automated dataset creation and analysis process, to enable reproduction and further analysis of our results. Overall, we hope our contributions provide important insights into the vulnerability discovery process and help in identifying effective techniques for vulnerability analysis and prevention.

Cybersecurity: a predictive analytical model for software vulnerability discovery process

ABSTRACT A software vulnerability is defined as a flaw that exists in computer resources or control that can be exploited by one or more threats. Vulnerabilities are discovered throughout the entire life cycle of the software. In this paper, we examine existing vulnerability models on the subject area and propose a new time-based differential equation model. Our proposed model is based on the assumption that vulnerability saturation is a local phenomenon, that possesses an increasing cyclic behaviour within the software vulnerability life cycle. Daily vulnerability data is extracted from the National Vulnerability Database (NVD) to obtain a cumulative quarterly vulnerability data set for three Operating Systems: Mac OS X, Windows 7, and Linux Kernel. When we apply the proposed model to this data, it is discovered that our model performs significantly better than existing models, in terms of fitting and prediction capabilities.

An updated analysis of seasonal variations of the security vulnerability discovery process

Several factors may influence the security vulnerability discovery rates. The projection of these rates might help the development and the prioritization of software patches. Previous work studied the seasonal behaviors of the vulnerability discovery process for several operating systems and web related software systems. We propose a replication study of an experiment conducted more than a decade ago to understand the changes in the dynamics of the security vulnerability discovery rates. In contrast to the findings from ten years ago, the investigated systems do not exhibit a year-end peak. Besides, the higher incidence during mid-year months for Microsoft operating systems was only noticed for the most recent Windows OSes: Windows 8.1 and Windows 10. These results highlight the importance of reproducibility in scientific works. In the area of cybersecurity, in particular, it is important that models are created from studies conducted using updated data.

On interdisciplinarity between product adoption and vulnerability discovery modeling

In the last three decades, Interdisciplinary research has attracted researchers, academicians, and practitioners from the varied field to collaborate and come up with the solution to a problem. This increase in interdisciplinary research is due to its ability to solve complex problems with the help of tools from various disciplines. Interdisciplinary research is based on some of the most important methods that were built through interdisciplinary study to examine and solve a wide variety of business and engineering related problems. Six applications of interdisciplinary research work done in the area of marketing and software security engineering have been discussed in this paper. Specifically, we have discussed the similarity of the modeling framework developed for product adoption using innovation diffusion modeling and vulnerability discovery process. From this work, we aim to provide an understanding to the readers about the importance of interdisciplinary research and its contribution to solving real-life complex decision problems by utilizing the knowledge of various disciplines together.

Modeling Software Vulnerability Discovery Process Inculcating the Impact of Reporters

Vulnerability Discovery Models (VDMs) attempt to estimate the potential vulnerabilities present in a software that will be discovered after a software is released. A general framework is required to encompass all the attributes such as number of detectors, their skill, market share, etc. that impact the discovery of vulnerability. VDMs have been developed by various industry and researchers to assess the vulnerability trend over time. In this proposal, we try to formulate the discovery process based on the software reporters that are the legitimately working to fetch-out the vulnerabilities in a software. The available reporters present in the market impact the discovery process significantly as a vulnerability is more likely to be discovered if a greater number of users are working simultaneously. The interdisciplinary approach highlights the association of vulnerability discovery process and the number of reporters. To empirically validate the preposition, we consider three datasets and the proposed methodology perform significantly better as compared to the traditional VDMs.

Periodicity in software vulnerability discovery, patching and exploitation

Periodicity in key processes related to software vulnerabilities need to be taken into account for assessing security at a given time. Here, we examine the actual multi-year field datasets for some of the most used software systems (operating systems and Web-related software) for potential annual variations in vulnerability discovery processes. We also examine weekly periodicity in the patching and exploitation of the vulnerabilities. Accurate projections of the vulnerability discovery process are required to optimally allocate the effort needed to develop patches for handling discovered vulnerabilities. A time series analysis that combines the periodic pattern and longer-term trends allows the developers to predict future needs more accurately. We analyze eighteen datasets of software systems for annual seasonality in their vulnerability discovery processes. This analysis shows that there are indeed repetitive annual patterns. Next, some of the datasets from a large number of major organizations that record the result of daily scans are examined for potential weekly periodicity and its statistical significance. The results show a 7-day periodicity in the presence of unpatched vulnerabilities, as well as in the exploitation pattern. The seasonal index approach is used to examine the statistical significance of the observed periodicity. The autocorrelation function is used to identify the exact periodicity. The results show that periodicity needs to be considered for optimal resource allocations and for evaluation of security risks.

Quantitative Risk Assessment in Moodle Learning Management System

For the past decade, in many educational institutes, learning management systems have become essential parts to deliver class materials and to provide communicational channels between course instructors and students. When institutes are adopting a learning management system, perhaps the two most concerning points would be how much a system costs to deploy and how secure a system is. Moodle, which is the most popular open software learning management system, satisfies a budget-related issue. Thus, as a low-cost solution, educational institutes often adopt Moodle. However, there have been few studies investigating the security aspects of Moodle, which might be more important than a budget problem. Here, we quantitatively investigate how secure Moodle system is. First, vulnerabilities discovered in Moodle are speculated with respect to the CVSS score. Then we apply a well-known vulnerability discovery model into the vulnerability discovery process. Also, we investigate whether there are seasonal variations in the discovery process. The result shows that a reasonably modified datasets are well followed the discovery model, and there is indeed a seasonal pattern in the Moodle vulnerability dataset.

Modeling Security Vulnerabilities in Learning Management Systems

In many educational institutes, learning management systems are essential parts of delivering class materials not only for on-line courses but also on-campus classes. The primary purpose of learning management system is to provide proper virtual educational environments and convenient communicational channels between instructors and students letting them to overcome the barrier of time and space for the general schooling. In this paper, we are investigating the security vulnerabilities in such learning management systems. Especially, we are examining the vulnerability discovery process in the two popular learning management systems, Moodle and Blackboard, using datasets spanning a decade. We applied two vulnerability discovery models to examine the vulnerability discovery process quantitatively. The discovery models allow us to estimate the approximate number of vulnerabilities likely to be discovered in software systems in the future. It also helps policy makers when they need to decide which learning management systems will be adopted for their organizations when security is an extremely important factor. Result shows that the vulnerability discovery process in learning management systems could be predictable which could be utilized for IT risk assessment in organizations having the systems.

Modeling vulnerability discovery process in Apache and IIS HTTP servers

Vulnerability discovery models allow prediction of the number of vulnerabilities that are likely to be discovered in the future. Hence, they allow the vendors and the end users to manage risk by optimizing resource allocation. Most vulnerability discovery models proposed use the time as an independent variable. Effort-based modeling has also been proposed, which requires the use of market share data. Here, the feasibility of characterizing the vulnerability discovery process in the two major HTTP servers, Apache and IIS, is quantitatively examined using both time and effort-based vulnerability discovery models, using data spanning more than a decade. The data used incorporates the effect of software evolution for both servers. In addition to aggregate vulnerabilities, different groups of vulnerabilities classified using both the error types and severity levels are also examined. Results show that the selected vulnerability discovery models of both types can fit the data of the two HTTP servers very well. Results also suggest that separate modeling for an individual class of vulnerabilities can be done. In addition to the model fitting, predictive capabilities of the two models are also examined. The results demonstrate the applicability of quantitative methods to widely-used products, which have undergone evolution.

Application of Vulnerability Discovery Models to Major Operating Systems

A number of security vulnerabilities have been reported in the Windows, and Linux operating systems. Both the developers, and users of operating systems have to utilize significant resources to evaluate, and mitigate the risk posed by these vulnerabilities. Vulnerabilities are discovered throughout the life of a software system by both the developers, and external testers. Vulnerability discovery models are needed that describe the vulnerability discovery process for determining readiness for release, future resource allocation for patch development, and evaluating the risk of vulnerability exploitation. Here, we analytically describe six models that have been recently proposed, and evaluate those using actual data for four major operating systems. The applicability of the proposed models, and the significance of the parameters involved are examined. The results show that some of the models tend to capture the discovery process better than others.