Home // SECURWARE 2018, The Twelfth International Conference on Emerging Security Information, Systems and Technologies // View article

Towards a Quantitative Approach for Security Assurance Metrics

Authors:
Goitom Weldehawaryat
Basel Katt

Keywords: Quantitative security assurance metrics; Security testing; Goal question metric (GQM); Common vulnerability scoring system (CVSS); Security metrics.

Abstract:
The need for effective and efficient evaluation schemes of security assurance is growing in many organizations, especially Small and Medium Enterprises (SMEs). Although there are several approaches and standards for evaluating application security assurance, they are qualitative in nature and depend to a great extent on manually processing. This paper presents a quantitative evaluation approach for defining security assurance metrics using two perspectives, vulnerabilities and security requirements. While vulnerability represents the negative aspect that leads to a reduction of the assurance level, security requirement improves the assurance posture. The approach employs both Goal Question Metric (GQM) and Common Vulnerability Scoring System (CVSS) methods. GQM is used to construct measurement items for different types of assurance metrics and assess the fulfillment of security requirements or the absence of vulnerabilities, and CVSS is utilized to quantify the severity of vulnerabilities according to various attributes. Furthermore, a case study is provided in this work, which measures and evaluates the security assurance of a discussion forum application using our approach. This can assist SMEs to evaluate the overall security assurance of their systems, and result in a measure of confidence that indicates how well a system meets its security requirements.

Pages: 13 to 20

Copyright: Copyright (c) IARIA, 2018

Publication date: September 16, 2018

Published in: conference

ISSN: 2162-2116

ISBN: 978-1-61208-661-3

Location: Venice, Italy

Dates: from September 16, 2018 to September 20, 2018