Using security metrics coupled with predictive modeling and simulation to assess security processes

: © Using Security Metrics Coupled with Predictive Modeling and Simulation to Assess Security Processes Yolanta Beres, Marco Casassa Mont, Jonathan Griffin, Simon Shiu HP Laboratories HPL-2009-142 Causal models, simulation, security processes, security metrics. It is hard for security practitioners and decision-makers to know what level of protection they are getting from their investments in security, especially when they have invested in a number of technologies and processes which interact and combine together. It is even harder to estimate how well these investments can be expected to protect their organizations in the future as security policies, regulations and the threat environment are constantly changing. In this paper we propose that for measuring the effectiveness of security processes in large organizations, a greater emphasis needs to be put on process-based metrics, in contrast to the more commonly used symptomatic lagging indicators. We show how these process-based metr...

• Type: Conference
• Year: 2009
• Where: ESEM
• Authors: Yolanta Beres, Marco Casassa Mont, Jonathan Griffin, Simon Shiu
• Keywords: ESEM 2009, Security, Security Metrics, Security Processes, Software Engineering