Failure-prone components are also attack-prone components
Michael Gegick · 2008
Limited resources preclude software engineers from finding and fixing all security vulnerabilities in a software system. A predictive model that identifies which components are attack-prone can prioritize fortification efforts where they are needed most. We have analyzed two large commercial telecommunications systems that have been deployed to the field. We have found strong correlations (as high as 0.82) between non-security failures and security failures and that the most failure-prone components are likely to be attack-prone. Additionally, non-security failures were found to be a good metric for estimating the count of security failures for a given software