@conference {870,
	title = {Software Vulnerability Fix Prioritization for x/rApps},
	booktitle = {Proceedings of the 2026 IEEE International Conference on Cyber Security and Resilience (CSR)},
	year = {2026},
	abstract = {<p>xApps and rApps are essential elements of the 6G framework, allowing for integration of AI-based functionality within the Open RAN (O-RAN) architecture, enhancing intelligence, automation and programmability. Their positioning in the O-RAN architecture enables them to access important resources of the 6G framework, therefore the security of xApps and rApps is critical. However, software programs may entail security issues, and security budget or roll-out time constraints may preclude the elimination of all identified issues, leading thus to residual impact, owing to security issues that are not fixed. In this paper, we present a method for prioritizing the fixing of security issues, in order to minimize the residual impact. The proposed method takes into account the attributes of the identified security issues, the relative importance of the confidence, integrity, and availability security dimensions, as well as the available security budget.</p>
},
	keywords = {6G network security, integer programming, rApps, residual impact, security issue prioritization, xApps},
	author = {Loukas Kopanias and Stefanos Vlachos and Nicholas Kolokotronis and Costas Vassilakis}
}
@article {823,
	title = {A Software Vulnerability Management Framework for the Minimization of System Attack Surface and Risk},
	journal = {Electronics},
	volume = {12},
	year = {2023},
	month = {may},
	pages = {2278},
	abstract = {<p>Current Internet of Things (IoT) systems comprise multiple software systems that are deployed to provide users with the required functionalities. System architects create system blueprints and draw specifications for the software artefacts that are needed; subsequently, either custom-made software is developed according to these specifications and/or ready-made COTS/open source software may be identified and customized to realize the overall system goals. All deployed software however may entail vulnerabilities, either due to insecure coding practices or owing to misconfigurations and unexpected interactions. Moreover, software artefacts may implement a much broader set of functionalities than may be strictly necessary for the system at hand, in order to serve a wider range of needs, and failure to appropriately configure the deployed software to include only the required modules results in the further increase of the system attack surface and the associated risk. In this paper, we present a software vulnerability management framework which facilitates (a) the configuration of software to include only the necessary features, (b) the execution of security-related tests and the compilation of platform-wide software vulnerability lists, and (c) the prioritization of vulnerability addressing, considering the impact of each vulnerability, the associated technical debt for its remediation, and the available security budget. The proposed framework can be used as an aid in IoT platform implementation by software architects, developers, and security experts.</p>
},
	keywords = {IoT systems, risk management, software vulnerabilities, system design, system security, technical debt},
	doi = {10.3390/electronics12102278},
	url = {https://doi.org/10.3390/electronics12102278},
	author = {Panagiotis Sotiropoulos and Christos-Minas Mathas and Costas Vassilakis and Nicholas Kolokotronis}
}
