From: Clairmont, Jan (JMC13mail3.cs.state.ny.us)
Date: Fri Jan 16 2004 - 12:34:46 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I agree combinatorial is probably a better factor of growth of possible
security errors.

Maybe an algorithm like Port Numbers Open factorial times the number of
applications on those ports factorial times number of code lines ! = number
of possible bugs-vulnerabilities.

Apps! * Ports! * Code Lines! = Possible Security Vulnerabilities or some
combinatorial proof a! * p! * c ! = s. Call it the the Clairmont-Everhart
Security Index of Vulnerability. The CSIV number, Nice point.

Factor in code lines too 8->, oh well so much for my dreams of being a
mathematician.

Anyone done this? I think there can ever be enough testing, and I think
if someone is dedicated enough an exploit can be found. I just think a
system becomes so hardened that the effort to exploit it or break it becomes
too onerous to do. Where as 1 billion monkeys pushing keys, someone is
going to stumble onto something, a key sequence timing error or other
weird combination of events that finds another bug or security hole.

Jan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]