> I'd be interested to see analyses of short term affects of breaches. A friend of mine pointed me to this paper:
http://www.heinz.cmu.edu/~rtelang/tse_published.pdf I have issues with the methodology - most notably, the study covers only 150 bugs out of thousands qualifying ones; half of them for a single vendor, Microsoft - so perhaps the study simply qualifies the wisdom of investing on some Tuesdays. (Inexplicably, just one bug is said to have affected Adobe between 1999 and 2004.) On top of that, it doesn't directly qualify gains / losses for a potential investment strategy. /mz _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
