Environment characterization and system modeling approach for the quantitative evaluation of security

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 5775 LNCS, Issue , 2009, Pages 89-102

  Vache, Geraldine ^a  

^a UNIVERSITÉ DE TOULOUSE   (France)

Author keywords

[No Author keywords available]

Indexed keywords

ENVIRONMENTAL FACTORS; IMPLEMENTATION ERROR; INFORMATION SYSTEM SECURITY; NEW APPROACHES; QUANTITATIVE EVALUATION; SECURITY SYSTEM STATE; STOCHASTIC ACTIVITY NETWORKS; SYSTEM DESIGNERS; SYSTEM ENVIRONMENT; SYSTEM MODELING; SYSTEM VULNERABILITY;

STOCHASTIC MODELS;

EID: 70350452986     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-642-04468-7_9     Document Type: Conference Paper

References (31)

1. U.S. Department of Defence Trusted Computer Security Evaluation Criteria (1985)
2. European Communities, Information Technology Security Evaluation Criteria (1991)
3. Common Criteria for Information Technology Security Evaluation (1996)
4. ISO/IEC 27001:2005, Requirements for Information security management systems (2005)
5. ISO/IEC 27002:2005, Code of practice for information security management (2005)
6. Jaquith, A.: Security metrics-Replacing fear, uncertainty, and doubt. Addison Wesley Professional, Reading (2007)
7. Laprie, J., Arlat, J., Blanquart, J., Costes, A., Deswarte, Y., Fabre, J., Guillermain, H., Kaǎniche, M., Kanoun, K., Mazet, C., Powell, D., Rabéjac, C., Thévenod, P.: Guide de la Sǔreté de Fonctionnement, Cépaduès (1995)
8. Brocklehurst, S., Littlewood, B., Olovsson, T., Jonsson, E.: On measurement of operational security. Aerospace and Electronic Systems Magazine, IEEE 9, 7-16 (1994)
9. Dacier, M.: Vers une évaluation quantitative de la sécurité informatique, Thèse de doctorat LAAS-CNRS (1994) (in french)
10. Dacier, M., Deswarte, Y., Kaǎniche, M.: Quantitative assessment of operational security: models and tools. CNRS-LAAS (1996)
11. Ortalo, R., Deswarte, Y., Kaaniche, M.: Experimenting with quantitative evaluation tools for monitoring operational security. IEEE Transactions on Software Engineering 25, 633-650 (1999)
12. Sheyner, O.M.: Scenario Graphs and Attack Graphs, PhD Thesis, Carnegie Mellon University, Pittsburgh, PA (2004)
13. Jha, S., Sheyner, O., Wing, J.: Two formal analyses of attack graphs. In: Proceedings of 15th IEEE Computer Security Foundations Workshop, 2002, pp. 49-63 (2002)
14. Swiler, L., Phillips, C., Ellis, D., Chakerian, S.: Computer-attack graph generation tool. In: Proceedings of DARPA Information Survivability Conference & Exposition II, DISCEX 2001, vol. 2, pp. 307-321 (2001)
15. Balzarotti, D., Monga, M., Sicari, S.: Assessing the risk of using vulnerable component, Quality of Protection, pp. 65-77. Springer, Heidelberg (2006)
16. McQueen, M.A., Boyer, W.F., Flynn, M.A., Beitel, G.A.: Time-to-Compromise model for cyber risk reduction estimation, Quality of Protection, pp. 49-64. Springer, Heidelberg (2006)
17. Mell, P., Scarfone, K., Romanovsky, S.: CVSS v2 Complete Documentation. ccvs (June 2007)
18. Frei, S., May, M., Fiedler, U., Plattner, B.: Large-scale vulnerability analysis. In: Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense, Pisa, Italy, pp. 131-138. ACM, New York (2006)
19. Jones, J.R.: Estimating Software Vulnerabilities. IEEE Security and Privacy 5, 28-32 (2007)
20. CVE - Common Vulnerabilities and Exposures (CVE), http://cve.mitre.org/
21. SecurityFocus, http://www.securityfocus.org
22. MAFTIA Consortium, Conceptual Model and Architecture of MAFTIA, MAFTIA (Malicious and Accidental Fault Tolerance for Internet Applications) project deliverable D21, LAAS-CNRS Report 03011 (1993)
23. Frei, S.: 0-day patch - Exposing vendors (In)security Performance, Amsterdam, NL
24. Fischbach, N.: Le cycle de vie d'une vulnérabilité (2003) (in french)
25. Microsoft Security Bulletin MS02-039
26. Computer Security Research - McAfee Avert Labs Blog
27. Vache, G.: Towards Information System Security Metrics. In: Proceedings of Seventh European Dependable Computing Conference, Kaunas, Lithuania, pp. 41-44 (2008)
28. Sanders, W.H., Meyer, J.F.: Stochastic Activity Networks: Formal definitions and concepts. Lectures on Formal Methods and Performance Analysis, pp. 315-343. Springer, Heidelberg (2001)
29. Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the Slammer worm. Security & Privacy 1, 33-39 (2003)
30. The Spread of the Sapphire/Slammer Worm, http://www.caida.org/ publications/papers/2003/sapphire/sapphire.html
31. The Mobiüs Tool, http://www.mobius.uiuc.edu/