Can we measure information security?

Reijo Savola; Anni Sademies; Jarkko Holappa

Can we measure information security?

Reijo Savola
, Anni Sademies
, Jarkko Holappa

VTT Technical Research Centre of Finland

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific

Abstract

The management of information security becomes easier if suitable metrics can be developed to offer evidence of the security level or performance of a system (e.g. a product or an organization). Results from measurements can be used as a basis for decisions in order to ensure the desired security level or performance. The measurement object of security metrics can be a technical system, an organization or a business process – or all of them at the same time. Systematic security metrics provide means for managing information security comprehensively.

Original language	English
Title of host publication	Proceedings of the European Intensive Programme on Information Security Management and Technology, IPICS 2006
Subtitle of host publication	The 7th Winter School
Publisher	University of Oulu
Number of pages	10
ISBN (Print)	951-42-8047-4
Publication status	Published - 2006
MoE publication type	B3 Non-refereed article in conference proceedings
Event	European Intensive Programme on Information Security Management and Technology, IPICS 2006: The 7th Winter School - Taivalkoski, Finland Duration: 3 Apr 2006 → 10 Apr 2006

Conference

Conference	European Intensive Programme on Information Security Management and Technology, IPICS 2006
Abbreviated title	IPICS 2006
Country/Territory	Finland
City	Taivalkoski
Period	3/04/06 → 10/04/06

Cite this

@inproceedings{236ff03271a147278aef1bcacb17c883,

title = "Can we measure information security?",

abstract = "The management of information security becomes easier if suitable metrics can be developed to offer evidence of the security level or performance of a system (e.g. a product or an organization). Results from measurements can be used as a basis for decisions in order to ensure the desired security level or performance. The measurement object of security metrics can be a technical system, an organization or a business process – or all of them at the same time. Systematic security metrics provide means for managing information security comprehensively.",

author = "Reijo Savola and Anni Sademies and Jarkko Holappa",

note = "CD-ROM; European Intensive Programme on Information Security Management and Technology, IPICS 2006 : The 7th Winter School, IPICS 2006 ; Conference date: 03-04-2006 Through 10-04-2006",

year = "2006",

language = "English",

isbn = "951-42-8047-4",

booktitle = "Proceedings of the European Intensive Programme on Information Security Management and Technology, IPICS 2006",