| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat May 13 00:06:24 2006 From: pbs-sf at dymaxion.org (Paul B. Saitta) Subject: Re: How secure is software X? On Fri, May 12, 2006 at 02:59:17AM +0100, David Litchfield wrote: > How secure is software X? > > At least as secure as Vulnerability Assessment Assurance Level P; or Q or > R. Well, that's what I think we should be able to say. What we need is an > open standard, that has been agreed upon by recognized experts, against > which the absence of software security vulnerability can be measured - > something which improves upon the failings of the Common Criteria. The Trike threat modeling methodology has as it's goal being able to produce exactly this kind of formal model of software risk -- models which have a high degree of real world relevancy, can be reliably generated by multiple teams, and compared across both different applications and different versions of an application. We're strongest right now on architectural level issues; the further into the details of the implementation, the more complex the model becomes, obviously. That said, formal threat models provide a solid analysis foundation to build on, and can work nicely with either automated test suites or more ad-hoc methods, including heuristics like previous bugs filed, number of code audits, etc. You can find a bit more at www.octotrike.org, but we've taken some pretty big steps from the work that's documented there. /P. -- Ideas are my favorite toys. -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 187 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060512/e6200619/attachment.bin
Powered by blists - more mailing lists