Thinking about software security metrics currently I've thought about the following software security metrics:
- number/type of CWE detected by developers (bug reporting)
- number/type of CWE detected by static analysis
- number/type of warning at compile time (i.e: from stack protector / fortify source )
- number/type of (presumed) memory leaks (running software under valgrind or whatever)
- number/type of unsafe function calls (sprintf instead of sNprintf)
Now the questions:
- What other security metrics on software do you suggest ?
- Is there a state-of-the art reference on this topic ?
I was able to found only security metrics on IT but not on softwares (software development).
The goals is to measure and have an overview on how bad/good are the softwares developed and measure where increase/decrease effort on secure software development practices or how/where security process needs some changes.