Quantitative security assurance metrics

Abstract

Security assurance is the confidence that a system meets its security requirements based on specific evidences that an assurance technique provide. The notion of measuring security is complex and tricky. Existing approaches do not conisder the relevance of the different security requirements to the evaluated application context. Furthermore, they are mostly qualitative in nature and are heavily based on manual processing, which make them costly and time consuming. Therefore, they are not widely used and applied, especially by small and medium-sized enterprises (SME), which constitute the backbone of the Norwegian economy, In this paper, we propose a quantification method that aims at evaluating security assurance of systems by measuring (1) the level of confidence that the mechanisms fulfilling security requirements are present and (2) the vulnerabilities associated with possible security threats are absent. Additionally, an assurance evaluation process is proposed. Two case studies applying our method are presented. The case studies use our assurance method to evaluate the security level of two REST APIs developed by Statistics Norway, where one of the authors is employed. One of the REST APIs is public and the other is private. Analyzes show that the API with the most security mechanisms implemented got a slightly higher security assurance score. This was due to the fact that the vulnerabilities were considered more harmful in one of the cases as the security objectives diverged.

System Security Assurance: A Systematic Literature Review

“…Security assurance is a complex and time-consuming process that goes throughout the development lifecycle of a (software) system begins from the protection profile initiation to the TOE certification. The security assurance process of a system requires a set of inputs such as TOE, the operational environment, assessment criteria and requirements (assurance profile), assurance methods, and assurance level [49]. This process goes through multiple stages and involves various activities such as defining security goals, security requirement analysis, threat analysis, vulnerability analysis, penetration testing, security audit, scoring, and analysis, etc.…”

“…Requirements Elicitation [36,49], Specification [43,49], Identification [14,49], Aggregation [49,85], Measurement [47,49], Prioritization [43], Modelling [49,52,100,109], Correctness [80], Tracing [36], Security Requirements Engineering Process [69],…”

“…NIST defined security assurance as a "measure of confidence that the security features, practices, procedures, and architecture of an information system accurately mediates and enforces the security policy" [86]. Katt and Prasher [49] defined security assurance as "the confidence that a system meets its security requirements and is resilient against security vulnerabilities and failures. "…”

Security and trust preserving inter‐ and intra‐cloud VM migrations

“…This analysis for different possible software configurations results in a discrete Trust Assurance Level (TAL value, eg, 1 to 10). 34 It is important to differentiate that the TAL value is assigned to a particular software stack as opposed to the Trust_Token which is issued to a particular cloud platform-though it also includes a TAL value.…”

“…In defining the possible roles of the PTAA, we envisage numerous use case scenarios based upon the types of cloud users. For example, in addition to TAL value evaluation for a software stack, 34 the PTAA can also suggest a mapping of a certain type of user security requirements to appropriate trust levels. This can be done by getting security requirements from the user using a questionnaire and suggest an appropriate TAL value for such user.…”