Assessing the risks of software vulnerabilities is a key process of software development and security management. This assessment requires to consider multiple factors (technical features, operational environment, involved assets, status of the vulnerability lifecycle, etc.) and may depend from the assessor's knowledge and skills. In this work, we tackle with an important part of this problem by measuring the accuracy of technical vulnerability assessments by assessors with dierent level and type of knowledge. We report an experiment to compare how accurately students with dierent technical education and security professionals are able to assess the severity of software vulnerabilities with the Common Vulnerability Scoring System (v3) industry methodology. Our results could be useful for increasing awareness about the intrinsic subtleties of vulnerability risk assessment and possibly better compliance with regulations. With respect to academic education, professional training and human resources selections our work suggests that measuring the effects of knowledge and expertise on the accuracy of software security assessments is feasible albeit not easy.
Measuring the accuracy of software vulnerability assessments: experiments with students and professionals / L. Allodi, M. Cremonini, F. Massacci, W. Shim. - In: EMPIRICAL SOFTWARE ENGINEERING. - ISSN 1382-3256. - 25:2(2020), pp. 1063-1094.
|Titolo:||Measuring the accuracy of software vulnerability assessments: experiments with students and professionals|
|Parole Chiave:||Software vulnerabilities; Risk assessment; Cybersecurity management; CVSS; Knowledge units; Professionalization|
|Settore Scientifico Disciplinare:||Settore INF/01 - Informatica|
Settore ING-INF/05 - Sistemi di Elaborazione delle Informazioni
|Data di pubblicazione:||2020|
|Digital Object Identifier (DOI):||http://dx.doi.org/10.1007/s10664-019-09797-4|
|Appare nelle tipologie:||01 - Articolo su periodico|
File in questo prodotto:
|Allodi2020_Article_MeasuringTheAccuracyOfSoftware.pdf||Articolo principale||Publisher's version/PDF||Open Access Visualizza/Apri|