Information Security Evaluation based on Requirements, Metrics and Evidence Information

Information security assurance and evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. We introduce an iterative process for security evaluation based on security requirements, metrics and evidence collection, and discuss its applicability to the design of security evaluation experimentation set-ups in real-world systems. In this approach, security requirements can be used to define the basis for security measurements. Furthermore, other kinds of security metrics and other security evidence can be used to security decision-making.