Towards integration of risk-driven and evidence driven information security measurement

Reijo Savola

doi:10.1109/ICAICT.2014.7035903

Towards integration of risk-driven and evidence driven information security measurement

Reijo Savola

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

Abstract

Carefully designed information security metrics enable informed and effective decision making. However, the current state of the art of developing security metrics is not sufficiently advanced. A major challenge is that typically the risk-driven (top-down modelling) and evidence-driven (bottom-up monitoring) metrics approaches are not aligned, and often used separately. Consequently, it is not possible to understand the impact of monitored evidence to actual security risk. A crosscut model for risk-driven and evidence-driven security metrology is needed. We analyze the concepts needed to be able to integrate these two main approaches.

Original language	English
Title of host publication	IEEE 8th International Conference on Application of Information and Communication Technologies (AICT 2014)
Publisher	IEEE Institute of Electrical and Electronic Engineers
Number of pages	6
ISBN (Electronic)	978-1-4799-4119-3, 978-1-4799-4121-6
ISBN (Print)	978-1-4799-4120-9
DOIs	https://doi.org/10.1109/ICAICT.2014.7035903
Publication status	Published - 2014
MoE publication type	A4 Article in a conference publication
Event	IEEE 8th International Conference on Application of Information and Communication Technologies, AICT2014 - Astana, Kazakhstan Duration: 15 Oct 2014 → 17 Oct 2014

Conference

Conference	IEEE 8th International Conference on Application of Information and Communication Technologies, AICT2014
Abbreviated title	AICT2014
Country/Territory	Kazakhstan
City	Astana
Period	15/10/14 → 17/10/14

Keywords

risk analysis
security metrics
security monitoring

Access to Document

10.1109/ICAICT.2014.7035903

Cite this

@inproceedings{cd1416de0dd64408850ef67ea2d29048,

title = "Towards integration of risk-driven and evidence driven information security measurement",

abstract = "Carefully designed information security metrics enable informed and effective decision making. However, the current state of the art of developing security metrics is not sufficiently advanced. A major challenge is that typically the risk-driven (top-down modelling) and evidence-driven (bottom-up monitoring) metrics approaches are not aligned, and often used separately. Consequently, it is not possible to understand the impact of monitored evidence to actual security risk. A crosscut model for risk-driven and evidence-driven security metrology is needed. We analyze the concepts needed to be able to integrate these two main approaches.",

keywords = "risk analysis, security metrics, security monitoring",

author = "Reijo Savola",

year = "2014",

doi = "10.1109/ICAICT.2014.7035903",

language = "English",

isbn = "978-1-4799-4120-9",

booktitle = "IEEE 8th International Conference on Application of Information and Communication Technologies (AICT 2014)",

publisher = "IEEE Institute of Electrical and Electronic Engineers",

address = "United States",

note = "IEEE 8th International Conference on Application of Information and Communication Technologies, AICT2014, AICT2014 ; Conference date: 15-10-2014 Through 17-10-2014",

}

Savola, R 2014, Towards integration of risk-driven and evidence driven information security measurement. in IEEE 8th International Conference on Application of Information and Communication Technologies (AICT 2014)., 7035903, IEEE Institute of Electrical and Electronic Engineers, IEEE 8th International Conference on Application of Information and Communication Technologies, AICT2014, Astana, Kazakhstan, 15/10/14. https://doi.org/10.1109/ICAICT.2014.7035903

Towards integration of risk-driven and evidence driven information security measurement. / Savola, Reijo.
IEEE 8th International Conference on Application of Information and Communication Technologies (AICT 2014). IEEE Institute of Electrical and Electronic Engineers, 2014. 7035903.

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

TY - GEN

T1 - Towards integration of risk-driven and evidence driven information security measurement

AU - Savola, Reijo

PY - 2014

Y1 - 2014

N2 - Carefully designed information security metrics enable informed and effective decision making. However, the current state of the art of developing security metrics is not sufficiently advanced. A major challenge is that typically the risk-driven (top-down modelling) and evidence-driven (bottom-up monitoring) metrics approaches are not aligned, and often used separately. Consequently, it is not possible to understand the impact of monitored evidence to actual security risk. A crosscut model for risk-driven and evidence-driven security metrology is needed. We analyze the concepts needed to be able to integrate these two main approaches.

AB - Carefully designed information security metrics enable informed and effective decision making. However, the current state of the art of developing security metrics is not sufficiently advanced. A major challenge is that typically the risk-driven (top-down modelling) and evidence-driven (bottom-up monitoring) metrics approaches are not aligned, and often used separately. Consequently, it is not possible to understand the impact of monitored evidence to actual security risk. A crosscut model for risk-driven and evidence-driven security metrology is needed. We analyze the concepts needed to be able to integrate these two main approaches.

KW - risk analysis

KW - security metrics

KW - security monitoring

U2 - 10.1109/ICAICT.2014.7035903

DO - 10.1109/ICAICT.2014.7035903

M3 - Conference article in proceedings

SN - 978-1-4799-4120-9

BT - IEEE 8th International Conference on Application of Information and Communication Technologies (AICT 2014)

PB - IEEE Institute of Electrical and Electronic Engineers

T2 - IEEE 8th International Conference on Application of Information and Communication Technologies, AICT2014

Y2 - 15 October 2014 through 17 October 2014

ER -

Towards integration of risk-driven and evidence driven information security measurement

Abstract

Conference

Keywords

Access to Document

Fingerprint

Cite this