## 2 Materials and Methods
### Prioritizing Security Fixes  
Following the stages of (a) security issue identification and (b) extraction of attributes for each security issue (potential for remote exploitation; impact on confidentiality, integrity and availability; time required for fixing the vulnerability), the framework executes a security issue prioritization step. The goal of this step is to consider a security budget allocation (which is expressed in terms of working hours), and arrange for assigning portions of the budget to the correction of security issues, in order to minimize the residual risk, i.e., the risk owing to the impact of security issues that cannot be fixed, due to security budget constraints. The security issue prioritization step is performed using linear programming [40]. More specifically, the framework formulates an integer programming optimization problem, where the optimization goal is the minimization of the residual security risk, whereas the available security budget is modeled as a constraint. The formulation of the integer programming optimization problem is presented in detail in the following paragraphs. The notations used in the integer programming problem formulation are listed in Table 1.  
At this stage, we consider that no detailed information is available for the following:  
* _The importance of each security dimension, either globally or per specific software deployment_. For instance, a web server may be used to make a public database available, and the integrity of the database records may be deemed more important than the availability of the service, while confidentiality may be considered of low importance (since the database is public). On the contrary, for a web server managing a health record database, all the security dimensions (confidentiality, integrity, and availability) may be deemed of high importance. * _The importance of each software deployment_. In the previous example, the impact of any demotion of the value of the public database may be deemed to be lower than the impact of a corresponding demotion in the value of the medical record database. Under the absence of the information listed above, the algorithm will operate under the assumption that (a) all security dimensions are of equal importance and (b) all software deployments are of equal importance. Extensions that will consider potential sources of additional information that will enable the algorithm to take into account variations in the importance of security dimensions and resources are considered part of our future work. The formulation of the integer programming problem proceeds as follows:  
* Firstly, the optimization target is formulated. Since the goal of the optimization is the minimization of the residual risk, which is mapped to the impact of the software vulnerabilities that remain unfixed, the objective function of the integer programming problem is \[minimize\sum_{i=1}^{N}RE_{i}*(1-x_{i})*I(S_{i})\] (2) where \(I(S_{i})\) is the security impact of vulnerability \(S_{i}\). The impact can be directly drawn from the vulnerability impact assessment step, as detailed in Section 2.5; if the vulnerability impact assessment step produces separate assessments of the vulnerability on the different security dimensions (confidentiality, integrity, and availability), the overall impact of the vulnerability can be estimated as the sum of its individual impact on each security dimension, i.e.,: \[I(S_{i})=I_{conf}(S_{i})+I_{integ}(S_{i})+Ii,avail(S_{i})\] (3) Note that in Equation (2) the impact of each vulnerability \(impact(S_{i})\) is multiplied (a) by the quantity \(RE_{i}\), positioning it so that only the impact of remotely exploitable