Information assurance techniques: Perceived cost effectiveness

Abstract

The assurance technique is a fundamental component of the assurance ecosystem; it is the mechanism by which we assess security to derive a measure of assurance. Despite this importance, the characteristics of these assurance techniques have not been comprehensively explored within academic research from the perspective of industry stakeholders. Here, a framework of 20 "assurance techniques" is defined along with their interdependencies. A survey was conducted which received 153 responses from industry stakeholders, in order to determine perceptions of the characteristics of these assurance techniques. These characteristics include the expertise required, number of people required, time required for completion, effectiveness and cost. The extent to which perceptions differ between those in practitioner and management roles is considered. The findings were then used to compute a measure of cost-effectiveness for each assurance technique. Survey respondents were also asked about their perceptions of complementary assurance techniques. These findings were used to establish 15 combinations, of which the combined effectiveness and cost-effectiveness was assessed.

Basic Cyber Hygiene: Does It Work?

“…To conduct the vulnerability assessment and assess the effectiveness of the 5 cyber essentials security controls, and due to the nature of SMEs that do not have the resources to separate testing from operational systems, we sought to avoid "active" security testing techniques like penetration testing, which may have an operational impact on this already resource-constrained type of businesses. Instead, we used a less aggressive approach, particularly using: architectural reviews, configuration reviews, and interviews, which are, however, known to be some of the most costeffective security testing techniques in practice [19]. As part of the assessment, we firstly mapped between the selected SME's characteristics (see below) and network features on the one hand and the 200 randomly selected vulnerabilities on the other hand.…”

Interventions for Software Security: Creating a Lightweight Program of Assurance Techniques for Developers

“…The coding process generated a set of intervention techniques, as shown in Table 1. The majority of these are already well known and documented; for these we have used the terminology defined by Such et al [4]. However, three of the practices-On-the-job Training, Incentivization Session, and Product Negotiation-are new in the context of security assurance techniques.…”

“…Existing research has identified a range of well-understood assurance techniques [4] used by security professionals to help improve the security of a system. Yet if we are to improve software security in a wide range of teams, we need approaches that work where resources may be limited and security expertise unavailable.…”

Interventions for long‐term software security: Creating a lightweight program of assurance techniques for developers

“…Existing research has identified a range of well‐understood assurance techniques used by security professionals to help improve the security of a system. However, if we are to improve software security in a wide range of teams, we need approaches that work where resources may be limited and security expertise unavailable.…”

“…Taking a different approach, Such et al investigated the economics of software security, surveying 150 security specialists to analyze the economics of different assurance techniques . The survey generated a taxonomy of twenty assurance techniques and found wide variations in the perceived cost effectiveness of each.…”