Bugtraq mailing list archives
Re: How secure is software X?
From: "Paul B. Saitta" <pbs-sf () dymaxion org>
Date: Fri, 12 May 2006 14:04:14 -0700
On Fri, May 12, 2006 at 02:59:17AM +0100, David Litchfield wrote:
How secure is software X? At least as secure as Vulnerability Assessment Assurance Level P; or Q or R. Well, that's what I think we should be able to say. What we need is an open standard, that has been agreed upon by recognized experts, against which the absence of software security vulnerability can be measured - something which improves upon the failings of the Common Criteria.
The Trike threat modeling methodology has as it's goal being able to produce exactly this kind of formal model of software risk -- models which have a high degree of real world relevancy, can be reliably generated by multiple teams, and compared across both different applications and different versions of an application. We're strongest right now on architectural level issues; the further into the details of the implementation, the more complex the model becomes, obviously. That said, formal threat models provide a solid analysis foundation to build on, and can work nicely with either automated test suites or more ad-hoc methods, including heuristics like previous bugs filed, number of code audits, etc. You can find a bit more at www.octotrike.org, but we've taken some pretty big steps from the work that's documented there. /P. -- Ideas are my favorite toys.
Attachment:
_bin
Description:
Current thread:
- How secure is software X? David Litchfield (May 12)
- Re: How secure is software X? Adam Shostack (May 12)
- Re: How secure is software X? Tim Newsham (May 12)
- Re: [Full-disclosure] How secure is software X? Michael Silk (May 12)
- Re: [Full-disclosure] How secure is software X? David Litchfield (May 12)
- Re: How secure is software X? Paul B. Saitta (May 15)
- Re: How secure is software X? Fabian Becker (May 15)
- Re: How secure is software X? Matt . Carpenter (May 15)
- Re: How secure is software X? Duncan Simpson (May 24)
- Re: How secure is software X? Crispin Cowan (May 23)
- Re: How secure is software X? Matt . Carpenter (May 15)
- <Possible follow-ups>
- RE: How secure is software X? Ferguson, Justin (IARC) (May 13)
- Re: How secure is software X? David Litchfield (May 13)