Improving system reliability by optimal allocation of resources for discovering software vulnerabilities. Issue 6 (23rd October 2019)

• Record Type: Journal Article
• Authors: Bhatt, Navneet; Anand, Adarsh; Aggrawal, Deepti
• Is Part Of: International journal of quality & reliability management. Volume 37:Issue 6/7(2020)
• Page Start: 1113
• Page End: 1124
• Publication Date: 2019-10-23
• Subjects: Reliability -- Resource allocation -- Severity -- Dynamic programming -- Software vulnerability; Quality control -- Periodicals; 658.562
• DOI: 10.1108/IJQRM-07-2019-0246
• Languages: English
• ISSNs: 0265-671X

Abstract

Abstract : Purpose: The purpose of this paper is to provide a mathematical framework to optimally allocate resources required for the discovery of vulnerabilities pertaining to different severity risk levels. Design/methodology/approach: Different sets of optimization problems have been formulated and using the concept of dynamic programming approach, sequence of recursive functions has been constructed for the optimal allocation of resources used for discovering vulnerabilities of different severity scores. Mozilla Thunderbird web browser data set has been considered for giving the empirical evaluation by working with vulnerabilities of different severities. Findings: As per the impact associated with a vulnerability, critical and high severity level are required to be patched promptly, and hence, a larger amount of funds have to be allocated for vulnerability discovery. Nevertheless, a low or medium risk vulnerability might also get exploited and thereby their discovery is also crucial for higher severity vulnerabilities. The current framework provides a diversified allocation of funds as per the requirement of a software manager and also aims at improving the discovery of vulnerability significantly. Practical implications: The finding of this research may enable software managers to adequately assign resources in managing the discovery of vulnerabilities. It may also help in acknowledging the funds required for various bug bounty programs to cater security reporters based on the potential number of vulnerabilities present in software. Originality/value: Much of the attention has been focused on the vulnerability discovery modeling and the risk associated with the security flaws. But, as far as the authors' knowledge is concern, there is no such study that incorporates optimal allocation of resources with respect to the vulnerabilities of different severity scores. Hence, the building block of this paper contributes to future research.