Formal approach to security metrics.

Abstract

Security metrics are the tools for providing correct and upto-date information about a state of security. This information is essential for managing security efficiently. Although a number of security metrics were proposed we still need reliable ways for assessment of security. First of all, we do not have a widely-accepted and unambiguous definition which defines what it means that one system is more secure than another one. Without this knowledge we cannot show that a metric really measures security. Second, there is no a universal formal model for all metrics which can be used for rigourous analysis. In this paper we investigate how we can define "more secure" relation and propose our basic formal model for a description and analysis of security metrics.

Artificial Intelligence-Driven Composition and Security Validation of an Internet of Things Ecosystem

“…A first theoretical work for the measurement of security is conducted in [58]. The authors document a formal model for the representation and evaluation of security metrics and define a set of relevant metrics.…”

“…For most composition techniques (e.g., [28,30,52]), the composition verification is modelled as interfaces, inputs/outputs, or plug-ins of the composing components. Then, validation methodologies can verify security properties based on theorems, polices, or contracts (e.g., [44][45][46][47][48][49][50][51][52][53][54][55][56][57][58]). Thereupon, methods that quantify security can evaluate the finally composed system (e.g., [45,52]).…”

“…In this section, we frame the systematic representation of the system's security aspects and composition. The methodology is based on EC and the theoretical research in [58].…”

Self-Advertising Attack Surfaces for Web Application Honeypots: New Technology to Managing Cyber Disasters

“…An application's attack surface measurement does not reflect the quality of the code of an application, and as such an application with a bigger attack surface does not necessarily mean it has many vulnerabilities and vice versa, but instead, a larger attack surface measurement reflects that an application is likely to be exploited with little effort and cause more damage to it. 11 So, does the quantity of attack surface parameters increase the attack surface of an application, or only a few have a significant influence towards the size of the attack surface of an application? Which attack surface parameters have a greater contribution to the size of the attack surface of an application?…”

Security in Embedded Systems: A Model-Based Approach with Risk Metrics

“…Surveys of risk analysis methods and corresponding metrics are presented by Verendel [241], Sulaman et al [242], Rudolph and Schwarz [243], Krautsevich et al [244], and Jansen [245] among others. For example, Verendel [241] analyses more than 100 approaches and metrics to quantify security.…”