Information assurance measures and metrics - State of practice and proposed taxonomy

Proceedings of the 36th Annual Hawaii International Conference on System Sciences, HICSS 2003

Volumn , Issue , 2003, Pages

  Vaughn, R B ^a   Henning, R ^b   Siraj, A ^a  

^a MISSISSIPPI STATE UNIVERSITY   (United States)

^b National Center for Health Statistics   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

SOFTWARE ENGINEERING;

ENGINEERING CORRELATIONS; ENGINEERING DISCIPLINES; INFORMATION ASSURANCE; SECURITY ENGINEERING; SECURITY MECHANISM; STATE OF PRACTICE; TECHNICAL RESOURCES; UNSOLVED PROBLEMS;

NETWORK SECURITY;

EID: 84969544889     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2003.1174904     Document Type: Conference Paper

References (25)

1. R. Vaughn, D. Dampier, and A. Siraj, "Information Security System Ranking and Rating", CrossTalk the Journal of Defense Software Engineering, May 2002, pp. 30-32.
2. Department of Defense Standard, Department of Defense Trusted Computer System Evaluation Criteria, DOD 5200.28-STD, GPO 1986-623-963, 1985.
3. ISO Standard 15408, The Common Criteria
4. Vaughn, R. and Henning, R. "A Report from the Workshop on Information Security System Rating and Ranking" Proceedings of the DOD Software Technology Conference 2002, Salt Lake City, Utah, April 29 - May 2, 2002. http://www.stc-online.org
5. G. Schuedel, and B. Wood,, "Adversary Work Factor as a Metric for Information Assurance", Proceedings of the New Security Paradigm Workshop, Sept 18-22, 2000, Ballycotton, Ireland.
6. Villasenor, P. V. (SAIC, DIAP). 2001. DoD operational metrics. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VR from May 21-23, 2001.
7. AFRL/IF. 2001. Information assurance metrics: Project overview. http://www.r1.af.mil/tech/programs/ia/ia12.html
8. Shapiro, S. (The MITRE Corporation). 2001. The bull in the china shop: The "Merrill Lynch" IA Assessment manifesto. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VA, May 21-23, 2001.
9. ISSRR. 2001. Proceedings Workshop on Information-Security-System Rating and Ranking (ISSRR) held in Williamsburg, VA, May 21-23, 2001. http://www.acsac.org/measurement/
10. Bartol, N. (Booz•Allen & Hamilton). 2001. IA metrics development and implementation. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VA, May 21-23, 2001.
11. McCallam, D. (Logicon). 2001. The case against numerical measures of information assurance. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VA, May 21-23, 2001.
12. Connolly, J. (The MITRE Corporation). 2001. Information Assurance operational readiness metrics. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VA, May 21-23, 2001
13. King. G. (Computer Science Corporation). 2000. Best Security Practices: An overview. http://csrc.nist.gov/nissc/2000/proceedings/papers/022.pdf
14. Swanson, M. (NIST). 2001. Self-assessment guide for information technology systems. http://csrc.nist.gov/publications/nistpubs/index.html
15. Schneider, E. A. (Institute of Defense Analysis). 2001. Measurements of system security. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VA, May 21-23, 2001.
16. ISC. 2001. International Information Systems Security Certification Consortium, Inc. http://www.isc2.org
17. Sandia National Laboratories. 2001. About IDART. http://www.sandia.gov/idart/about.htm
18. Air Force Communication Agency (AFCA). 1997. Information Protection metrics and measurements program. http://afpubs.hq.af.mil/pubfiles/af/33/afi33-205/afi33-205.pdf
19. Downs, D. D. and R. Haddad. (The Aerospace Corporation). 2001. Penetration testing - The gold standard for security rating and ranking. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VA, May 21-23, 2001.
20. Wood, B. J. and J. F. Bouchard. (Cyber Defense Research Center, SRI). 2001. Red team work factor as a security measurement. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VA, May 21-23, 2001.
21. Moitra S.D. and S. L. Konda. (SEI). 2000. The survivability of network systems: An empirical analysis. CMU/SEI-2000-TR-021. http://www.sei.cmu.edu/publications/documents/00.reports/00tr021.html
22. Kahn, J. J. (The MITRE Corporation). 2001. Certification of Intelligence Community Systems and measurement of residual risks. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VR from May 21-23, 2001.
23. Bayuk, J. (ITG Security, Bear Stearns & Co. Inc.). 2001. Measuring security. In proceedings of the Workshop on Information-Security-System Rating and Ranking held in Williamsburg, VA, May 21-23, 2001.
24. Lindqvist U. and E. Jonsson. 1997. How to systematically classify computer security intrusions. In Proceedings of the 1997 IEEE Symposium on Security and Privacy held in Oakland, CA from May 4-7, 1997.
25. Vaughn, R. and Henning, R. 2002. "A Report from the Workshop on Information Security System Rating and Ranking" Proceedings of the 14th Annual Canadian Information Technology Security Symposium, Ottawa Canada, May 13-17, 2002.