Formal modeling of vulnerability

One concept underlies the entire realm of computer security — vulnerability. Without vulnerability, there is neither security nor the need for it. Surprisingly, the term vulnerability remains ill defined. We developed and adopted a working definition: A vulnerability is an unplanned system feature that an intruder may exploit, if he/she can establish certain preconditions, to achieve particular impacts on that system that violate its security policy. Our goal was to represent vulnerability in a formal sense and to learn from that representation. We set out to answer the question, “Is it possible to construct a formal model of the domain of computer security vulnerabilities that is sufficiently robust to uncover meaningful relationships among multiple vulnerabilities that were not already recognized?” We model security-related facts in simple propositional logic, construct a graph of temporal dependencies among vulnerabilities, and analyze the resulting graph visualization.