25th USENIX Security Symposium has ended
Back To Schedule
Monday, August 8 • 11:00am - 11:30am
Can Knowledge of Technical Debt Help Identify Software Vulnerabilities?

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Software vulnerabilities originating from design decisions are hard to find early and time consuming to fix later. We investigated whether the problematic design decisions themselves might be relatively easier to find, based on the concept of “technical debt,” i.e., design or implementation constructs that are expedient in the short term but make future changes and fixes more costly. If so, can knowing which components contain technical debt help developers identify and manage certain classes of vulnerabilities? This paper provides our approach for using knowledge of technical debt to identify software vulnerabilities that are difficult to find using only static analysis of the code. We present initial findings from a study of the Chromium open source project that motivates the need to examine a combination of evidence: quantitative static analysis of anomalies in code, qualitative classification of design consequences in issue trackers, and software development indicators in the commit history.


Rick Kazman

Principal Researcher, SEI
avatar for Dr. Ipek Ozkaya

Dr. Ipek Ozkaya

Technical Director, Engineering Intelligent Software Systems, CMU SEI
Ipek Ozkaya is the technical director of the Engineering Intelligent Software Systems group at the SEI. Ozkaya’s primary interests include developing techniques for improving software development efficiency and system evolution with an emphasis on software architecture practices... Read More →

Monday August 8, 2016 11:00am - 11:30am PDT
Texas Ballroom 2–3

Attendees (4)