Towards Security Evaluation Based on Evidence Collection

Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. Here we introduce a general-level holistic framework for security evaluation based on security behaviour modelling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation setups in real-world systems. KEY WORDS Information security evaluation, security metrics, security modelling, security testing 

• Type: Conference
• Year: 2006
• Where: FSKD
• Authors: Reijo Savola
• Keywords: FSKD 2006, Fuzzy Logic, Information Security Evaluation, Security Behaviour Modelling, Security Evaluation