Michael Howard's recent blog entry points us to an article he wrote for IEEE. Here are two interesting quotes from the paper which may be found here:
“Note that, although a general bug count is interesting and useful, we find no evidence at Microsoft of a correlation between general bug quantity and security bug quantity.”
“But first, it’s important to understand one simple rule: you must always know what the attacker controls. If the attacker controls nothing, there’s no security bug; if the attacker controls a great deal of data used in the code, the potential for a security bug skyrockets.”
Popularity: 3%
