tools. Howard, Manadhata, and Wing have formalized the “attack surface”
[Howard2003] [Manadhata2005] as a means of evaluating software security
quantitatively, most recently by comparing the attack surface of two FTP servers
[Manadhata2006]. While it seems likely that the attack surface is correlated with the