TUTCRIS - Tampereen teknillinen yliopisto

TUTCRIS

Software vulnerability life cycles and the age of software products: An empirical assertion with operating system products

Tutkimustuotosvertaisarvioitu

Yksityiskohdat

AlkuperäiskieliEnglanti
OtsikkoAdvanced Information Systems Engineering Workshops - CAiSE 2016 International Workshops, Proceedings
KustantajaSpringer Verlag
Sivut207-218
Sivumäärä12
ISBN (painettu)9783319395630
DOI - pysyväislinkit
TilaJulkaistu - 2016
Julkaistu ulkoisestiKyllä
OKM-julkaisutyyppiA4 Artikkeli konferenssijulkaisussa
Tapahtuma28th Conference on Advanced Information Systems Engineering, CAiSE 2016 held in conjunction with ASDENCA, BumDISE, COGNISE, EnBIS, EM, WISSE 2016 - Ljubljana, Slovenia
Kesto: 13 kesäkuuta 201617 kesäkuuta 2016

Julkaisusarja

NimiLecture Notes in Business Information Processing
Vuosikerta249
ISSN (painettu)18651348

Conference

Conference28th Conference on Advanced Information Systems Engineering, CAiSE 2016 held in conjunction with ASDENCA, BumDISE, COGNISE, EnBIS, EM, WISSE 2016
MaaSlovenia
KaupunkiLjubljana
Ajanjakso13/06/1617/06/16

Tiivistelmä

This empirical paper examines whether the age of software products can explain the turnaround between the release of security advisories and the publication vulnerability information. Building on the theoretical rationale of vulnerability life cycle modeling, this assertion is examined with an empirical sample that covers operating system releases from Microsoft and two Linux vendors. Estimation is carried out with a linear regression model. The results indicate that the age of the observed Microsoft products does not affect the turnaround times, and only feeble statistical relationships are present for the examined Linux releases. With this negative result, the paper contributes to the vulnerability life cycle modeling research by presenting and rejecting one theoretically motivated and previously unexplored question. The rejection is also a positive result; there is no reason for users to fear that the turnaround times would significantly lengthen as operating system releases age.