A Security Metrics Taxonomization Model for Software-Intensive Systems
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
We introduce a novel high-level security metrics objective taxonomization model for software- intensive systems. The model systematizes and organizes security metrics development activities. It focuses on the security level and security performance of technical systems while taking into account the alignment of metrics objectives with different business and other management goals. The model emphasizes the roles of security-enforcing mechanisms, the overall security quality of the system under investigation, and secure system lifecycle, project and business management. Security correctness, effectiveness and efficiency are seen as the fundamental measurement objectives, determining the directions for more detailed security metrics development. Integration of the proposed model with riskdriven security metrics development approaches is also discussed.
Abstract
We introduce a novel high-level security metrics objective taxonomization model for software- intensive systems. The model systematizes and organizes security metrics development activities. It focuses on the security level and security performance of technical systems while taking into account the alignment of metrics objectives with different business and other management goals. The model emphasizes the roles of security-enforcing mechanisms, the overall security quality of the system under investigation, and secure system lifecycle, project and business management. Security correctness, effectiveness and efficiency are seen as the fundamental measurement objectives, determining the directions for more detailed security metrics development. Integration of the proposed model with riskdriven security metrics development approaches is also discussed.
참고문헌 (39)
- R.Savola, "A Taxonomical Approach for Information Security Metrics Development", Nordsec ‘07 Supplemental Booklet of Short Papers, pp.11~12 (2007)
- Directions in Security Metrics Research, "W.Jansen", NIST, 21~, pp.NISTIR 7564 (2009)
- R.Savola, "Towards a Taxonomy for Information Security Metrics", QoP ’07,Alexandria, pp.28~30 (2007)
- R.Savola, "A Novel Security Metrics Taxonomy for R&D Organizations", ISSA ’08,Johannesburg, pp.379~390 (2008)
- R. Henning, "Proceedings of Workshop on Information Security System,Scoring and Ranking – Information System Security Attribute Quantification or Ordering", ACSA and MITRE (2001)
- N. Seddigh, "Current Trenes and Advances in Information Assurance Metrics", PST ’04,Fredericton (2004)
- M.Swanson, "Security Self-Assessment Guide for Information Technology Systems", NIST Special Publication, 800(26) (2001)
- M. Swanson, "Security Metrics Guide for Information Technology Systems", NIST Special Publication, 800(55) (2003)
- R. Vaughn, "Information Assurance Measures and Metrics:State of Practice and Proposed Taxonomy", HICSS ’03 (2003)
- R. Savola, "Identification of Basic Measurable Security Components for a Distributed Messaging System", SECURWARE ’09, pp.121~128 (2009)
- Measuring Cyber Security and Information Assurance:a State-of-the-Art Report, "N. Bartol", Information Assurance Technology Analysis Center (IATAC), ~ (2009)
- A.Jaquith, "Security Metrics:Replacing Fear,Uncertainty and Doubt" (2007), Addison-Wesley
- D.S.Herrmann, "Complete Guide to Security and Privacy Metrics – Measuring Regulatory Compliance,Operational Resilience and ROI" (2007), Auerbach Publications
- D.B.Parker, "Computer Security Management" (1981), Reston Publishing Company
- ITU-T Recommendation X.805, "Security Architecture for Systems Providing End-to-End Communications", ~ (2003)
- D. Longley, "Data and Computer Security:Dictionary of Standards,Concepts and Terms" (1987), Macmillan
- D.Gollmann, "Computer Security" (1999), John Wiley & Sons
- R.C.Summers, "Secure Computing,Threats and Safeguards" (1997), McGraw-Hill
- A. Avižienis, "Basic Concepts and Taxonomy of Dependable and Secure Computing", IEEE Tr.on Dependable and Secure Computing, 1(1), pp.11~33 (2004)
- B.S.Yee, "Security Metrology and the Monty Hall Problem", Workshop on Information Security System Scoring and Ranking(WISSSR),ACSA and MITRE (2002)
- Security Measurement – White Paper, Vers. 3.0, "Practical Software & Systems Measurement Safety and Security Technical Working Group", 67~ (2007)
- M. Howard, "Measuring Relative Attack Surfaces", Workshop on Advanced Developments in Software and Systems Security (2003)
- A Formal Model for a System’s Attack Surface, "P. K. Manadhata", ~, pp.Technical Report CMU-CS-07-144 (2007)
- Information Technology – Systems Security Engineering – Capability Maturity Model(SSE-CMM), "ISO", IEC 21827:2003, IEC, pp.2003, ~[DOI]
- R. Kailar, "On the Security Effectiveness of Cryptographic Protocols", 4th IFIP Working Conf.on Dependable Computing for Critical Applications, 9 (1994)
- C. Wang, "Towards a Framework for Security Measurement", 20th National Information Systems Security Conference, pp.522~533 (1997)
- M. Schiffman, "CVSS:a Common Vulnerability Scoring System", U.S.National Infrastructure Advisory Council(NIAC) (2004)
- R.A.Martin, "Managing Vulnerabilities in Networked Systems", IEEE Computer Society Computer Magazine, 34(11) (2001)
- M. Barrett, "Guide to Adopting and Using the Security Content Automation Protocol(SCAP)", NIST Special Publication, 800(117) (2009)
- B.Schneier, "Attack Trees", Dr.Dobb’s Journal, 24(12) (1999)
- S.E.Schechter, "Computer Security Strength & Risk:a Quantitative Approach", Ph.D, pp.2004
- S.S.Stevens, "On the Theory of Scales of Measurement", Science, 103(2684), pp.677~680 (1946)
- R.Savola, "Requirement Centric Security Evaluation of Software Intensive Systems", DepCOSRELCOMEX ’07, pp.135~142 (2007)
- R.Savola, "Development of Security Metrics for a Distributed Messaging System", AICT ’09,Baku,Azerbaijan, pp.6~ (2009)
- R.Savola, "A Security Metrics Development Method for Software Intensive Systems", ISA ’09, Springer CCIS, 36, pp.11~16 (2009)
- J.McHugh, "Quantitative Measures of Assurance:Prophecy,Process or Pipedream?", Workshop on Information Security System Scoring and Ranking(WISSSR),ACSA and MITRE (2001)
- D.McCallam, "The Case Against Numerical Measures of Information Assurance", Workshop on Information Security System Scoring and Ranking(WISSSR),ACSA and MITRE (2001)
- S.M.Bellovin, "On the Brittleness of Software and the Infeasibility of Security Metrics", IEEE Security & Privacy, pp.96~ (2006)
- P. Burris, "A Few Good Security Metrics" (2000), METAGroup Inc.