Here is the matrix presented by Jacob West and Alexander Hoole from HP Fortify at RSA 2012. They look at security bugs along 2 different dimensions:

Explicit in Code
Implied in Code

Generic
50% - Can be found by static analysis tools
Can be found in pen testing or expert reviews

Application-Specific
Need to understand application patterns ( Read more... )

Here is the matrix presented by Jacob West and Alexander Hoole from HP Fortify at RSA 2012. They look at security bugs along 2 different dimensions:

Explicit in Code
Implied in Code

Generic
50% - Can be found by static analysis tools
Can be found in pen testing or expert reviews

Application-Specific
Need to understand application patterns ( Read more... )