The risks with security metrics

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2008, Pages 65-69

  Aime, Marco D ^a   Atzeni, Andrea ^a   Pomi, Paolo C ^a  

^a POLITECNICO DI TORINO   (Italy)

Author keywords

Management; Reliability; Security

Indexed keywords

MEASUREMENT PROCESS; SECURITY; SECURITY EVALUATION; SECURITY EXPERTS; SECURITY METRICS;

EID: 70349260162     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1456362.1456376     Document Type: Conference Paper

References (21)

1. R. Agrawal, T. Imielinski, and A. Swami. Mining association rules between sets of items in large databases. In Proceedings of the 1993 ACM SIGMOD international conference on Management of data, June 1993.
2. M. D. Aime, A. Atzeni, and P. C. Pomi. Ambra - automated model-based risk analysis. In Proc. of the 2007 ACM Workshop on Quality of Protection (QoP'07), pages 43-48, 29 October 2007.
3. A. Atzeni and A. Lioy. Why to adopt a security metric? A brief survey. In QoP2005, First Int. Workshop on Quality of Protection, pages 1-12, 15 September 2005.
4. A. Avizienis, J. C. Laprie, and B. Randell. Dependability and its threats: A taxonomy. In Proc. of IFIP 18th World Computer Congress, pages 91-120, 22-27 August 2004.
5. M. Dacier. Towards Quantitative Evaluation of Computer Security. PhD thesis, Institute National Politechnique de Toulose, 1994.
6. FIRST. Common Vulnerability Scoring System (CVSS). http://www.first.org/ cvss/cvss-guide.html.
7. K. Fowler and J. Schmalzel. Why do we care about measurement? Instrumentation & Measurement Magazine, IEEE, 7(1):38-46, March 2004.
8. M. Howard, J. Pincus, and J. Wing. Computer Security in the 21st Century, chapter 8, pages 109-137. Springer, March 2005.
9. ISO/IEC 27004. Information technology - Security techniques - Information security management - Measurements - draft. ISO/IEC, 2006.
10. F. Iwu and I. Toyn. Modelling and analysing faultpropagation in safety-related systems. In 28th Annual NASA Goddard Software Engineering Workshop, York (UK), pages 167-174, 3-4 Dec 2003.
11. N. Kavantzas, D. Burdett, G. Ritzinger, T. Fletcher, Y. Lafon, and C. Barreto. Web services choreography description language version 1.0. W3C Recommendation, http://www.w3.org/TR/ws-cdl-10/, November 2005.
12. N. Leveson. A new accident model for engineering safer systems. In Safety ScienceVolume 42, Issue 4, pages 237-270, April 2004.
13. B. Martin, C. Sullo, and J. Kouns. OSVDB: Open Source Vulnerability Database. http://www.osvdb.org/database-info.php.
14. Ministerio de Administraciones Publicas. Methodology for information systems risk analysis and management (MAGERIT) version 2. http://www.csae.map. es/.
15. D. Nicol, W. Sanders, and K. Trivedi. Model-based evaluation: from dependability to security. IEEE Transactions on Dependable and Secure Computing, 1(1):48-65, Jan.-March 2004.
16. NIST. National vulnerability database. http://nvd.nist.gov/.
17. X. Ou, W. F. Boyer, and M. A. McQueen. A scalable approach to attack graph generation. In CCS '06: Proc. of the 13th ACM conference on Computer and communications security, pages 336-345, 2006.
18. POSITIF Project. System Description Language (PSDL). http://www.positif. org/.
19. R. W. Ritchey and P. Ammann. Using model checking to analyze network vulnerabilities. In Proc. of IEEE Computer Society Symposium on Security and Privacy, pages 156-165, May 2000.
20. R. Sawilla and X. Ou. Googling attack graphs. In Technical Report for Defence R&D Canada Ottawa, September 2007.
21. The DMTF Technical Committee. The Common Information Model. http://www.dmtf.org/standards/cim.