A requirement centric framework for information security evaluation

Reijo Savola

doi:10.1007/11908739_4

A requirement centric framework for information security evaluation

Reijo Savola

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

2 Citations (Scopus)

Abstract

Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. We introduce a general-level holistic framework for security evaluation based on security behavior modeling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation set-ups in real-world systems.

Original language	English
Title of host publication	Advances in Information and Computer Security
Subtitle of host publication	First International Workshop on Security, IWSEC 2006, Kyoto, Japan, October 23-24, 2006. Proceedings
Publisher	Springer
Pages	48-59
ISBN (Electronic)	978-3-540-47700-6
ISBN (Print)	3-540-47699-7, 978-3-540-47699-3
DOIs	https://doi.org/10.1007/11908739_4
Publication status	Published - 2006
MoE publication type	A4 Article in a conference publication

Publication series

Series	Lecture Notes in Computer Science
Volume	4266
ISSN	0302-9743

Access to Document

10.1007/11908739_4

Cite this

@inproceedings{284953d0e529416aa091f01d932074ec,

title = "A requirement centric framework for information security evaluation",

abstract = "Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. We introduce a general-level holistic framework for security evaluation based on security behavior modeling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation set-ups in real-world systems.",

author = "Reijo Savola",

year = "2006",

doi = "10.1007/11908739_4",

language = "English",

isbn = "3-540-47699-7",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "48--59",

booktitle = "Advances in Information and Computer Security",

address = "Germany",

}

A requirement centric framework for information security evaluation. / Savola, Reijo.
Advances in Information and Computer Security: First International Workshop on Security, IWSEC 2006, Kyoto, Japan, October 23-24, 2006. Proceedings. Springer, 2006. p. 48-59 (Lecture Notes in Computer Science, Vol. 4266).

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

TY - GEN

T1 - A requirement centric framework for information security evaluation

AU - Savola, Reijo

PY - 2006

Y1 - 2006

N2 - Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. We introduce a general-level holistic framework for security evaluation based on security behavior modeling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation set-ups in real-world systems.

AB - Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. We introduce a general-level holistic framework for security evaluation based on security behavior modeling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation set-ups in real-world systems.

U2 - 10.1007/11908739_4

DO - 10.1007/11908739_4

M3 - Conference article in proceedings

SN - 3-540-47699-7

SN - 978-3-540-47699-3

T3 - Lecture Notes in Computer Science

SP - 48

EP - 59

BT - Advances in Information and Computer Security

PB - Springer

ER -

A requirement centric framework for information security evaluation

Abstract

Publication series

Access to Document

Fingerprint

Cite this