6.3.1 Secure Adaptive Response Potential (SARP): A System Security Metric

Abstract

Abstract. System design, development and operational activities are monitored and evaluated to facilitate proper system security management in all phases of the system life-cycle. Effective system security metrics must address all phases of the system life-cycle as well as the associated organizational elements that interact during the system life-cycle to produce and operate the system of interest. A single system security metric, built from multiple components, is presented here as a fundamental system management security metric. This single technical security metric is used to support and evaluate the allocation of corporate and program resources, including time and budget.Introduction. The current state of the international information technology (IT) infrastructure is an artifact of over twenty five years of explosive system and infrastructure growth. This phenomenal growth was based, in the beginning, on a few architectural and operational principles relating to open systems interconnection and open network interfaces. As the systems developed, the original system architectural principles were augmented with commercial and business decisions aimed at market dominance, "first-mover" status and system ease-of-use features. These factors, taken as a collective whole, created an IT infrastructure of physical components, software products and computing services that are not naturally secure (Schneier 2007). The value added by network-enabled capabilities must now be evaluated and balanced against the expected value loss from the existing, insecure, IT infrastructure.The daily challenge facing current system and organizational managers is the balancing of the great value gained from network-centric and network-enabled systems with the increasing security threats associated with network components that are fundamentally insecure. Assisting and guiding IT and corporate managers in the journey from high-value, high-threat IT networks to a future of high-value, highly secure IT networks is the primary purpose of the secure adaptive response potential (SARP) system security metric.

3.2.1 System Security Capability Assessment Model Development and Application

“…The output from a SSCAM activity could be used as input to a structured evaluation technique that evaluates the most effective methods to address any indicated security short falls found in the SSCAM QL or SSCAM process assessments. The secure adaptive response potential (SARP) metric was developed to directly support this type of management decision making (Simpson 2008).…”

Secure Software Education

“…The Microsoft Security Development Lifecycle process is an example of this type of stand-alone security life-cycle process. (Simpson, Miller, & Dagli, 2008). SARP can be used to guide programmatic decision and resource allocation.…”

“…Step 8: Prioritize requirements The complete system scope as well as the attention to value, threat and function in the APM support the activity of requirements prioritization. The structured information and data associated with the APM can be used as direct inputs for formal ranking tools like the analytical hierarchy process (AHP) (Simpson, Miller, & Dagli, June, 2008).…”

“…Specific instances of software security applications and techniques are mapped to a specific operational context, and are evaluated using a secure adaptive response potential (SARP) system security metric, which was introduced earlier in the paper. The SARP security metric was designed to address system security operational suitability throughout the system lifecycle (Simpson, Miller, & Dagli, June, 2008). Specific classes of system operational suitability may be developed and categorized using the SARP metric components that generally describe the operation and maintenance profile of the deployed system.…”

“…(1) asset management, (2) configuration management, (3) compliance management and (4) vulnerability management. Simpson, 2008) enumeration, open vulnerability and assessment language, and the common vulnerability scoring system. The common vulnerability enumeration is an extensive list of publicly known information security vulnerabilities and exposures.…”