Relating Software Coupling Attribute and Security Vulnerability Attribute

Both internal software properties, such as cohesion and coupling, and external software properties, such as performance or security, have been extensively studied [2,11,13]. In this paper we pose a metric for an external property, security vulnerability, using aspects from coupling, which is an internal property. We introduce two metrics, Average Vulnerability (AV) and Degree of Vulnerability (DV), to gauge the extent of security vulnerability. Then these metrics are applied to the top ten security vulnerable components in Mozilla as described by Neuhaus et al [7]. High associations are found between these metrics and the top ten vulnerable components. This result provides a direction that future design review and testing should focus on coupling properties when security is specified as an important factor in the requirements specification.