@inproceedings{17b8d3f1bbfe4115995e24a7ccafd871,
title = "A security metrics development method for software intensive systems",
abstract = "It is a widely accepted management principle that an activity cannot be managed well if it cannot be measured. Carefully designed security metrics can be used to offer evidence of the security behavior of the system under development or operation. We propose a systematic and holistic method for security metrics development for software intensive systems. The approach is security requirement-centric and threat and vulnerability-driven. The high-level security requirements are expressed in terms of lower-level measurable components applying a decomposition approach. Next, feasibility of the basic measurable components is investigated, and more detailed metrics developed based on selected components.",
author = "Reijo Savola",
year = "2009",
doi = "10.1007/978-3-642-02633-1_2",
language = "English",
isbn = "978-3-642-02632-4",
series = "Communications in Computer and Information Science",
publisher = "Springer",
pages = "11--16",
booktitle = "Proceedings of the 3rd International Conference on Advances in Information Security and Its Application, ISA 2009",
address = "Germany",
}