Security vulnerabilities are systemic in large information and communication systems.
The complexity of these systems breeds design, implementation and management errors- all of which can lead to security vulnerabilities. To better understand the unwanted role of vulnerabilities in large systems, we have developed a life-cycle model for security vulnerabilities. Using our model, we examine several vulnerabilities through analysis of historical incident data collected by the CERT Coordination Center. The results of our examination show that the first order driving force behind intrusions is the automation of the vulnerability. Our results further show that the life expectancy of vulnerabilities is far longer than expected, and that this time can be shortened substantially through effective and active systems management.