Formal Analysis of Security Metrics and Risk

1. Bae, S.J., et al.: Degradation models and implied lifetime distributions. Reliability Engineering & System Safety 92(5), 601–608 (2007)

   Article  MathSciNet  Google Scholar 

2. Butler, S.A.: Security attribute evaluation method: a cost-benefit approach. In: Proceedings of the 24th International Conference on Software Engineering (ICSE 2002), pp. 232–240. ACM Press, New York (2002)

   Chapter  Google Scholar 

3. Casola, V., et al.: A SLA evaluation methodology in Service Oriented Architectures. In: Proceedings of the 1st Workshop on Quality of Protection, Milan, Italy. Springer, Heidelberg (2005)

   Google Scholar 

4. Eloff, M.M., von Solms, S.H.: Information security management: An approach to combine process certification and product evaluation. Computers & Security 19(8), 609–698 (2000)

   Article  Google Scholar 

5. Gordon, L., Loeb, M.: The economics of information security investment. ACM Transactions on Information and System Security 5(4), 438–457 (2003)

   Article  Google Scholar 

6. Gordon, L.A., Loeb, M.P.: Managing Cybersecurity Resources: a Cost-Benefit Analysis. McGraw-Hill, New York (2006)

   Google Scholar 

7. Herrmann, D.S.: Complete Guide to Security and Privacy Metrics. Measuring Regulatory Compliance, Operational Resilience, and ROI. Auerbach Publications (2007)

   Google Scholar 

8. ISO/IEC. ISO/IEC 27002:2005 Information technology – Security techniques – Code of Practice for Information Security Management (2005)

   Google Scholar 

9. Jansen, W.: Directions in security metric research. Technical Report NISTIR 7564, National institute of Standards and Technology (2009)

   Google Scholar 

10. Jaquith, A.: Security metrics: replacing fear, uncertainty, and doubt. Addison-Wesley, Reading (2007)

    Google Scholar 

11. Jonsson, E., Olovsson, T.: A quantitative model of the security intrusion process based on attacker behavior. IEEE Transactions on Software Engineering 23(4), 235–245 (1997)

    Article  Google Scholar 

12. Karjoth, G., et al.: Service-oriented assurance comprehensive security by explicit assurances. In: Proceedings of the 1st Workshop on Quality of Protection, Milan, Italy, Springer, Heidelberg (2005)

    Google Scholar 

13. Krautsevich, L., et al.: Formal approach to security metrics. what does “more secure” mean for you? In: Proceedings of the 1st International Workshop on Measurability of Security in Software Architectures, ACM Press, New York (2010)

    Google Scholar 

14. Madan, B.B., Goseva-Popstojanova, K., Vaidyanathan, K., Trivedi, K.S.: A method for modeling and quantifying the security attributes of intrusion tolerant systems. Performance Evaluatin Journal 4(56), 167–186 (2004)

    Article  Google Scholar 

15. Manadhata, P., Wing, J.: Measuring a system’s attack surface. Technical Report CMU-TR-04-102, Carnegie Mellon University (2004)

    Google Scholar 

16. Manadhata, P., Wing, J.M.: An attack surface metric. Technical Report CMU-CS-05-155, School of Computer Science. Carnegie Mellon University (2005)

    Google Scholar 

17. Manadhata, P.K., et al.: An approach to measuring a systems attack surface. Technical Report CMU-CS-07-146, School of Computer Science. Carnegie Mellon University (2007)

    Google Scholar 

18. Mullen, R.: The lognormal distribution of software failure rates: application to software reliability growth modeling. In: The Ninth International Symposium on Software Reliability Engineering, pp. 134–142 (November 1998)

    Google Scholar 

19. Ortalo, R., et al.: Experimenting with quantitative evaluation tools for monitoring operational security. IEEE Transactions on Software Engineering 25(5), 633–650 (1999)

    Article  Google Scholar 

20. Pamula, J., et al.: A weakest-adversary security metric for network configuration security analysis. In: QoP 2006: Proceedings of the 2nd ACM workshop on Quality of Protection, pp. 31–38. ACM Press, New York (2006)

    Chapter  Google Scholar 

21. Schechter, S.E.: How to buy better testing. In: Davida, G.I., Frankel, Y., Rees, O. (eds.) InfraSec 2002. LNCS, vol. 2437, pp. 73–87. Springer, Heidelberg (2002)

    Chapter  Google Scholar 

22. Stewart, A.: On risk: perception and direction. Computers & Security 23(5), 362–370 (2004)

    Article  Google Scholar 

23. Stoneburner, G., et al.: Risk management guide for information technology systems. Technical Report 800-30, National Institute of Standards and Technology (2001)

    Google Scholar 

24. Swanson, M., et al.: Security metrics guide for information technology systems. Technical Report 800-55, National Institute of Standards and Technology (2003)

    Google Scholar 

25. Vaughn, R.B., et al.: Information assurance measures and metrics - state of practice and proposed taxonomy. In: Proceedings of the 36th Annual Hawaii International Conference on System Sciences (January 2003)

    Google Scholar 

26. Wang, L., et al.: An attack graph-based probabilistic security metric. In: Proceeedings of the 22nd annual IFIP WG 11.3 working conference on Data and Applications Security, pp. 283–296. Springer-, Heidelberg (2008)

    Google Scholar 

27. Wang, L., et al.: Minimum-cost network hardening using attack graphs. Computer Communications 29(18), 3812–3824 (2006)

    Article  Google Scholar 

Download references