Patent ID: 7299497

Claim:
A method for determining a relative susceptibility of a computing product to attack, the method comprising: an act of identifying one or more avenues of attack that correspond to a computing product, each avenue of attack including a way the product can be attacked; an act of determining a bias value for each identified avenues of attack, the bias value based upon an objective measure of the potential damage that can be caused by each identified avenue of attack, a higher bias value representing a greater potential damage; and an act of calculating an attack surface quotient for the computing product, the act of calculating comprising: for each identified avenue of attack, an act of applying the bias value that corresponds to the identified avenue of attack, the act of applying the bias value including an act of multiplying the bias value and the corresponding identified avenue of attack to obtain a resulting bias-applied value; and combining the resulting bias-applied values by summing all the resulting bias-applied values for each identified avenue of attack.