One software security metric that is already in use is Microsoft’s Relative
Attack Surface Quotient (RASQ),referred to by Steve Bellovin in his Metricon
address. Developed with the assistance of CMU to compensate forthe lack
of common standards for software security metrics, RASQ measures the