https://media.ccc.de/c/34c3/34c3-9225-how_risky_is_the_software_you_use

CITL: Quantitative, Comparable Software Risk Reporting

Software vendors like to claim that their software is secure, but the effort and techniques applied to this end vary significantly across the industry. From an end-user's perspective, how do you identify those vendors who are effective at securing their software? From a vendor's perspective, how do you identify those techniques which are effective at improving security? Presenting joint work with Sarah Zatko, mudge, Patrick Stach, and Parker Thompson.

Tim Carstens & Parker Thompson

https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events/9225.html