Two-phase methodology for prioritization and utility assessment of software vulnerabilities

Misbah Anjum (), Vernika Agarwal (), P. K. Kapur () and Sunil Kumar Khatri ()
Additional contact information
Misbah Anjum: Amity University
Vernika Agarwal: Amity University
P. K. Kapur: Amity University
Sunil Kumar Khatri: Amity University

International Journal of System Assurance Engineering and Management, 2020, vol. 11, issue 2, No 17, 289-300

Abstract: Abstract There seems to be a system or piece of software for everything nowadays—from an application that lets you explore internet browsers to virtual reality software. This growth in the online domain is pushing the software developers to create safer products and enhance the protection of sensitive user information. This security issue is becoming even more critical due to the rise of cyber-attacks; the industry hence is giving foremost attention to the testing and development phase. Since there can be several flaws or weaknesses in the software or an operating system, that could allow an attacker to compromise the integrity, availability, or confidentiality of a product, commonly termed as software vulnerabilities. Thus, the first step is to understand which type of vulnerability is the most crucial to minimize the losses. Multi-criteria decision-making techniques, therefore, help to prioritize these vulnerabilities. In this paper, we apply two-phase methodology, comprising of the analytic hierarchy process (AHP) and best–worst method (BWM) in the first phase followed by the two-way assessment technique in the second phase, which helps in assessing the vulnerabilities in terms of their utility. The model is validated using real-life data of a software testing and development company situated in the northern part of India. The results show that the BWM performed significantly better as compared to the AHP approach in terms of utility.

Keywords: Vulnerability; Two-phase methodology; Analytic hierarchy process; Best–worst method; Two-way assessment (search for similar items in EconPapers)
Date: 2020
References: View references in EconPapers View complete reference list from CitEc
Citations: View citations in EconPapers (1)

Downloads: (external link)
http://link.springer.com/10.1007/s13198-020-00957-0 Abstract (text/html)
Access to the full text of the articles in this series is restricted.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:spr:ijsaem:v:11:y:2020:i:2:d:10.1007_s13198-020-00957-0

Ordering information: This journal article can be ordered from
http://www.springer.com/engineering/journal/13198

DOI: 10.1007/s13198-020-00957-0

Access Statistics for this article

International Journal of System Assurance Engineering and Management is currently edited by P.K. Kapur, A.K. Verma and U. Kumar

More articles in International Journal of System Assurance Engineering and Management from Springer, The Society for Reliability, Engineering Quality and Operations Management (SREQOM),India, and Division of Operation and Maintenance, Lulea University of Technology, Sweden
Bibliographic data for series maintained by Sonal Shukla () and Springer Nature Abstracting and Indexing ().