On the Brittleness of Software and the Infeasibility of Security Metrics

Authors: S.M. Bellovin

Complete Citation

On the Brittleness of Software and the Infeasibility of Security Metrics, Bellovin, S.M.; Security & Privacy Magazine, IEEE, Volume 4, Issue 4, July-Aug. 2006 Page(s):96 - 96

Abstract

How secure is a computer system? Bridges have a load limit, but it isn't determined (as "Calvin and Hobbes" would have it) by building an identical bridge and running trucks over it until it collapses. In a more relevant vein, safes are rated for how long they'll resist attack under given circumstances. Can we do the same for software?

Annotations

"Until we can measure security, we can't improve it."

-- AndrewBlaich - 19 Dec 2007