TY - CONF T1 - Maintaining software with a security perspective T2 - Software Maintenance, 2002. Proceedings. International Conference on Y1 - 2002 A1 - Jiwnani,K. A1 - Zelkowitz, Marvin V KW - (computers); KW - budget KW - classification KW - classification; KW - constraints; KW - data; KW - engineering; KW - flaw KW - maintenance; KW - of KW - operating KW - program KW - scheme; KW - Security KW - software KW - stable KW - system KW - systems KW - systems; KW - testing; KW - TIME KW - vulnerabilities; KW - vulnerability AB - Testing for software security is a lengthy, complex and costly process. Currently, security testing is done using penetration analysis and formal verification of security kernels. These methods are not complete and are difficult to use. Hence it is essential to focus testing effort in areas that have a greater number of security vulnerabilities to develop secure software as well as meet budget and time constraints. We propose a testing strategy based on a classification of vulnerabilities to develop secure and stable systems. This taxonomy will enable a system testing and maintenance group to understand the distribution of security vulnerabilities and prioritize their testing effort according to the impact the vulnerabilities have on the system. This is based on Landwehr's (1994) classification scheme for security flaws and we evaluated it using a database of 1360 operating system vulnerabilities. This analysis indicates vulnerabilities tend to be focused in relatively few areas and associated with a small number of software engineering issues. JA - Software Maintenance, 2002. Proceedings. International Conference on M3 - 10.1109/ICSM.2002.1167766 ER -