An analysis of how many undiscovered vulnerabilities remain in information systems

• Main Author: Spring, J.M (Author)
• Format: Article
• Language: English
• Published: Elsevier Ltd 2023
• Subjects: Economic of information security; Economics; Economics of information; Economics of information security; Information management; Information systems; Information use; Investment strategy; Investments; Management strategies; Organisational; Resilient systems; Security of data; Security policy; Security systems; Software engineering; Strategic planning; Through the lens; Turing machine; Turing machines; Vulnerability analysis; Vulnerability management
• Online Access: View Fulltext in Publisher; View in Scopus
• ISBN: 01674048 (ISSN)
• DOI: 10.1016/j.cose.2023.103191

Vulnerability management strategy, from both organizational and public policy perspectives, hinges on an understanding of the supply of undiscovered vulnerabilities. If the number of undiscovered vulnerabilities is small enough, then a reasonable investment strategy would be to focus on finding and removing the remaining undiscovered vulnerabilities. If the number of undiscovered vulnerabilities is and will continue to be large, then a better investment strategy would be to focus on quick patch dissemination and engineering resilient systems. This paper examines a paradigm, namely that the number of undiscovered vulnerabilities is manageably small, through the lens of mathematical concepts from the theory of computing. From this perspective, we find little support for the paradigm of limited undiscovered vulnerabilities. We then briefly support the notion that these theory-based conclusions are relevant to practical computers in use today. We find no reason to believe undiscovered vulnerabilities are not essentially unlimited in practice and we examine the possible economic impacts should this be the case. Based on our analysis, we recommend vulnerability management strategy adopts an approach favoring quick patch dissemination and engineering resilient systems, while continuing good software engineering practices to reduce (but never eliminate) vulnerabilities in information systems. © 2023