Problem areas in computer security assessment

Toward cost-sensitive modeling for intrusion detection and response

“…The issues involved in the measurement of cost factors have been studied by the computer risk analysis and security assessment communities. The literature suggests that attempts to fully quantify all factors involved in cost modeling usually generate misleading results because not all factors can be reduced to discrete dollars (or some other common unit of measurement) and probabilities [3,6,9,10,13]. It is recommended that qualitative analysis be used to measure the relative magnitudes of cost factors.…”

Measuring Risk: Computer Security Metrics, Automation, and Learning

“…50 They concluded, "we prefer to leave it as an open question whether or not a quantitative assessment methodology can ever be developed." 50 Indeed, risk assessors did not even agree on terminology. At the 1978 workshop, a session on managerial and organizational vulnerabilities and controls noted, Efforts of this group were hampered in the identification of vulnerabilities and controls by a lack of adequate definition of critical terminology such as threats, vulnerabilities, risk, risk analysis, and risk assessment.…”

“…50 Such models were useless because they "assume that we are able to supply values for the parameters of the model which, in fact, we are not able to supply." 50 By contrast, Courtney, who spoke immediately prior to the RAND researchers at the 1977 National Computer Security Conference, acknowledged that precise data was not available but insisted that order of magnitude estimates were usually sufficient. 46 Some researchers sought to make uncertainties more explicit in computer security risk assessment.…”

A Data Mining approach for building cost-sensitive and light intrusion detection models

“…The issues involved in the measurement of cost factors have been studied by the computer risk analysis and security assessment communities. The literature suggests that attempts to fully quantify all factors involved in cost modeling usually generate misleading results because not all factors can be reduced to discrete dollars (or some other common unit of measurement) and probabilities [18,19,20,21,22]. It is recommended that qualitative analysis be used to measure the relative magnitudes of cost factors.…”