Evaluation and Selection of Software Vulnerabilities

Abstract

Information systems are an integral part of every organization’s critical resource and are an important responsibility of all organizations in this digital world to defend them from attacks. Misuse of critical systems of data raises serious difficulties to organizations which involve loss of productivity, profits, company loss, credibility loss and often, legal issues. This paper develops a framework to analyze the optimal selection of vulnerabilities having maximum severity and can be resolved in minimum time. In this study, an integrated framework involving Analytical Hierarchy process (AHP) and Entropy method is used to calculate the subjective and objective weights of software vulnerabilities. Severity of vulnerabilities is then computed by taking into consideration the combined weights calculated from AHP and Entropy method. To select the most critical vulnerability, a bi-objective programming problem is used with the objective of weight maximization and time minimization. The weighted goal programming approach is used to achieve a compromise between conflicting objectives and to achieve a satisfactory solution to the bi-objective problem. The findings are tested in the Delhi-National Capital Region by a software firm.