Modeling of Security Measurement Metrics in an Information System

Abstract

Security metrics and measurement is a sub-field of broader information security field. This field newlineis not new but it got very least and sporadic attention as a result of which it is still in its early newlinestages. The measurement and evaluation of security now became a long standing challenge to the newlineresearch community. Much of the focus remained towards devising and the application of new newlineand updated protection mechanisms. Measurements in general act as a driving force in decision making. newlineThe information systems are comprised of various components such as people, hardware, data, newlinenetwork and software. With the fast growing reliance on the software systems, the research newlinereported in this thesis aims to provide a framework using mathematical modeling techniques for newlineevaluation of security of the software systems at the architectural and design phase of the system newlinelifecycle and the derived security metrics on a controlled scale from the proposed framework. newlineThe proposed security evaluation framework is independent of the programing language and the newlineplatform used in developing the system and also is applicable from small desktop application to newlinelarge complex distributed software. The validation process of security metrics is the most newlinechallenging part of the security metrics field. In this thesis we have conducted the exploratory newlineempirical evaluation on a running system to validate the derived security metrics and the newlinemeasurement results. To make the task easy we have transformed the proposed security evaluation into algorithmic form which increased the applicability of the proposed framework newlinewithout requiring any expert security knowledge. The motivation of the research is to provide the software development team with a tool to newlineevaluate the level of security of each of the element of the system and the overall system at the early development stages of the system life cycle. newlineWhat is to be newlinemeasured? where (in the system life cycle) to measure? how to measure? newlineanswered in the thesis