System Security Assurance: A Systematic Literature Review

Abstract

Security assurance provides the confidence that security features, practices, procedures, and architecture of software systems mediate and enforce the security policy and are resilient against security failure and attacks. Alongside the significant benefits of security assurance, the evolution of new information and communication technology (ICT) introduces new challenges regarding information protection. Security assurance methods based on the traditional tools, techniques, and procedures may fail to account new challenges due to poor requirement specifications, static nature, and poor development processes. The common criteria (CC) commonly used for security evaluation and certification process also comes with many limitations and challenges. In this paper, extensive efforts have been made to study the state-of-the-art, limitations and future research directions for security assurance of the ICT and cyber-physical systems (CPS) in a wide range of domains. We systematically review the requirements, processes, and activities involved in system security assurance including security requirements, security metrics, system and environments and assurance methods. We shed light on the challenges and gaps that have been identified by the existing literature related to system security assurance and corresponding solutions. Finally, we discussed the limitations of the present methods and future research directions.CCS Concepts: • General and reference → Surveys and overviews; • Security and privacy → Systems security.

Exploring the role of assurance context in system security assurance evaluation: a conceptual model

“…In recent years, there has been a significant surge in research efforts dedicated to SAE methodologies (Shukla et al, 2021). This increased focus has led to the development of numerous frameworks, models and techniques that are specifically designed to assess and enhance the security of systems.…”