Applied Comparative Evaluation of the Metasploit Evasion Module The great revitalization of information and communication technologies has facilitated broad connectivity to the Internet. However, this convenience in terms of connectivity comes with costly caveats, including internet fraud, information damage or theft, and cybersecurity issues. Most individuals rely on antivirus software for protection. This antivirus software has long been a foe to malware authors, but there are brief moments when new techniques slip through the cracks, and even the most sophisticated engines sometimes fail. A new tool, namely Metasploits new evasion modules, claims to exploit that. In this study, we compare and evaluate legacy evasion techniques with the novel tactics presented by Metasploits lead researcher Wei Chen. We consider the benefits and pitfalls of each technique and evaluate the new modules successes (or failures!).

Measuring the accuracy of software vulnerability assessments: experiments with students and professionals Assessing the risks of software vulnerabilities is a key process of software development and security management. This assessment requires to consider multiple factors (technical features, operational environment, involved assets, status of the vulnerability lifecycle, etc.) and may depend from the assessorxe2x80x99s knowledge and skills. In this work, we tackle with an important part of this problem by measuring the accuracy of technical vulnerability assessments by assessors with different level and type of knowledge. We report an experiment to compare how accurately students with different technical education and security professionals are able to assess the severity of software vulnerabilities with the Common Vulnerability Scoring System (v3) industry methodology. Our results could be useful for increasing awareness about the intrinsic subtleties of vulnerability risk assessment and possibly better compliance with regulations. With respect to academic education, professional training and human resources selections our work suggests that measuring the effects of knowledge and expertise on the accuracy of software security assessments is feasible albeit not easy.