Question

Microsoft program security issues. To help its users combat malicious attacks (e.g., worms, viruses) on its computer software, Microsoft periodically issues a security bulletin that reports the software affected by the vulnerability. In Computers & Security (July 2013), researchers focused on reported security issues with three Microsoft products: Office, Windows, and Explorer

a. In a sample of 50 security bulletins issued in a recent year, 32 reported a security issue with Windows, 6 with Explorer, and 12 with Office. Construct a pie chart to describe the Microsoft products with security issues. Which product had the lowest proportion of security issues?

b. The researchers also categorized the security bulletins according to the expected repercussion of the vulnerability. Categories were Denial of service, Information disclosure, Remote code execution, Spoofing, and Privilege elevation. Suppose that of the 50 bulletins sampled, the following numbers of bulletins were classified into each respective category: 6, 8, 22, 3, 11. Construct a Pareto diagram to describe the expected repercussions from security issues. Based on the graph, what repercussion would you advise Microsoft to focus on?

Short answer

a.

Explorer” has the lowest security issues.

b.

Step-by-step solution

Describing the pie chart

The calculations of the class percentages of the security bulletins are shown below:

$$\begin{gathered} \mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage =}}\frac{\mathbf{\text{Observed}}\mathbf{ }\mathbf{\text{number}}\mathbf{ }\mathbf{\text{in}}\mathbf{ }\mathbf{\text{that}}\mathbf{ }\mathbf{\text{category}}}{\mathbf{\text{Total number}}\mathbf{ }\mathbf{\text{of security}}\mathbf{ }\mathbf{\text{bulletins}}} \\ \mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage of Windows =}}\frac{\mathbf{\text{32}}}{\mathbf{\text{50}}}\mathbf{\times }\mathbf{100} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{=}\mathbf{64}\mathbf{\%} \\ \mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage of Explorer =}}\frac{\mathbf{\text{6}}}{\mathbf{\text{50}}}\mathbf{\times }\mathbf{100} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{=}\mathbf{12}\mathbf{\%} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage of Office =}}\frac{\mathbf{\text{12}}}{\mathbf{\text{50}}}\mathbf{\times }\mathbf{100} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{=}\mathbf{24}\mathbf{\%} \end{gathered}$$

The percentages are accordingly used to form the pie chart from where it can be deduced that “Explorer” has the lowest proportion of security issues.

Preparing the Pareto diagram

The calculations of the class percentages of Windows, Explorer, and Office are shown below:

$$\begin{gathered} \mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage of Denial of service =}}\frac{\mathbf{\text{6}}}{\mathbf{\text{50}}}\mathbf{\times }\mathbf{100} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{=}\mathbf{12}\mathbf{\%} \\ \mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage of Information disclosure =}}\frac{\mathbf{\text{8}}}{\mathbf{\text{50}}}\mathbf{\times }\mathbf{100} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{=}\mathbf{16}\mathbf{\%} \\ \mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage of remote code execution =}}\frac{\mathbf{\text{22}}}{\mathbf{\text{50}}}\mathbf{\times }\mathbf{100} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{=}\mathbf{44}\mathbf{\%} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage of spoofing =}}\frac{\mathbf{\text{3}}}{\mathbf{\text{50}}}\mathbf{\times }\mathbf{100} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{=}\mathbf{6}\mathbf{\%} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{\text{Class}}\mathbf{ }\mathbf{\text{percentage of priviledge elevation =}}\frac{\mathbf{\text{11}}}{\mathbf{\text{50}}}\mathbf{\times }\mathbf{100} \\ \mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{}\mathbf{=}\mathbf{22}\mathbf{\%} \end{gathered}$$

By arranging the class percentages in the order from the largest to the smallest, the Pareto diagram is formed, which is similar to a bar graph.