A framework for system security assessment

Proceedings from the 6th Annual IEEE System, Man and Cybernetics Information Assurance Workshop, SMC 2005

Volumn 2005, Issue , 2005, Pages 224-231

  Hallberg, Jonas ^a   Hunstad, Amund ^a   Peterson, Mikael ^a  

^a NONE

Author keywords

IT security; Securability; Security level; Security metrics; System security assessment

Indexed keywords

COMPUTER APPLICATIONS; COMPUTER NETWORKS; DATA STRUCTURES; INFORMATION TECHNOLOGY;

IT SECURITY; SECURABILITY; SECURITY LEVEL; SECURITY METRICS; SYSTEM SECURITY ASSESSMENT;

SECURITY SYSTEMS;

EID: 33745445395     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IAW.2005.1495956     Document Type: Conference Paper

References (20)

1. Greenwald, M., Gunter, C., Knutsson, B., Scedrov, A., Smith, J., & Zdancewic, S. (2003), Computer security is not a science, Large-Scale Network Security Workshop, Landsdowne, VA.
2. ACSA (2002), Proc. Workshop on Information Security System Scoring and Ranking. Applied Computer Security Associates, http://www.acsac.org/measurement/ proceedings/wisssrl-proceedings.pdf
3. Hunstad, A., Hallberg, J. & Andersson, R., Measuring IT security - a Method Based on Common Criteria's Security Functional Requirements, Proceedings of the 5th IEEE Workshop on Information Assurance. West Point, NY, June 2004.
4. Hallberg, J., Hunstad, A., Bond, A., Peterson, M., Påhlsson, N., (2004). System IT Security Assessment, FOI-R-1468-SE, Linköping, Sweden.
5. Schneier, B. (2000). Secrets & Lies - Digital Security in a Networked World. John Wiley &. Sons.
6. Hunstad, A. & Hallberg, J. (2002). Design for securability - Applying engineering principles to the design of security architectures. ACSA workshop on the application of engineering principles to system security design. Boston, Nov. 6-8, 2002. Linköping, FOI 2002, 8 p. (FOI-S-0721-SE)
7. Secmet (2004). Security metrics consortium. WWW page (visited 2005-03-10). http://www.secmet.org/
8. Leung, H. (2001). Quality metrics for intranet applications. Information & Management 38 (2001). Pages 137-152.
9. Vaughn, R., Henning, R., & Siraj, A. (2003). Information Assurance Measures and Metrics - State of Practice and Proposed Taxonomy. Proceedings of the Hawaii International Conference on System Sciences, Waikoloa, Hawaii, January 6-9, 2003.
10. Alger, J. (2001) On Assurance, Measures, and Metrics: Definitions and Approaches. http://philby.ucsd.edu/~cse291_IDVA/papers/rating-position/Alger.pdf
11. Payne, S. (2001). A Guide to Security Metrics. SANS Security Essentials GSEC Practical Assignment. http://www.sans.org/rr/whitepapers/auditing/55.php
12. Swanson, M., Bartol, N., Sabato, J., & Hash, J. (2003). Security metrics guide for information technology systems. NIST Special Publication 800-55, NIST, July 2003. http://csrc.nist.gov/publications/nistpubs/800-55/ sp800-55.pdf
13. Peterson, M. (2004). CAESAR - A proposed method for evaluating security in component-based distributed information systems. Master's Thesis. LITH-ISY-EX-3581-2004. Linköpings universitet.
14. Clark, K., Tyree, S., Dawkins, J., & Hale, J. (2004). Qualitative and Quantitative Analytical Techniques for Network Security Assessment, Proceedings of the 5th IEEE Workshop on Information Assurance. West Point, NY, June 2004.
15. Hunstad, A. &. Hallberg, J. (2002), Modeling of Distributed Systems Focusing on IT Security Aspects, FOI-R - 0712-SE, FOI, Linköping, Sweden.
16. Oman, P., Krings, A., Conte de Leon, D., & Alves-Foss, J. (2004). Analyzing the Security and Survivability of Real-time Control Systems. Proceedings of the 5th IEEE Workshop on Information Assurance. West Point, NY, June 2004.
17. Eschelbeck, G. (2000). Active Security - A proactive approach for computer security systems. Journal of Network and Computer Applications, Vol. 23, No.2, April 2000, pp. 109-130.
18. Blobel, B. & Roger-France, F. (2001), A systematic approach for analysis and design of secure health information systems, International Journal of Medical Informatics, Vol. 62, Issue 1, pp. 51-78, June 2001.
19. Whitmore, J.J (2001). A method for designing secure solutions. IBM Systems Journal, Armonk 2001, Vol. 40, Issue 3.
20. Roberts, F. (1979). Measurement Theory with Applications to Decision-making. Utility, and the Social Sciences. Addison-Wesley.