Towards security effectiveness measurement utilizing risk-based security assurance

Reijo Savola; Heimo Pentikäinen; Moussa Ouedraogo

doi:10.1109/ISSA.2010.5588322

Towards security effectiveness measurement utilizing risk-based security assurance

Reijo Savola, Heimo Pentikäinen, Moussa Ouedraogo

Public Research Centre Henri Tudor

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

11 Citations (Scopus)

Abstract

Systematic and practical approaches to risk-driven operational security evidence help ensure the effectiveness and efficiency of security controls in business-critical applications and services.
This paper introduces an enhanced methodology to develop security effectiveness metrics that can be used in connection with correctness assurance of security controls.
This methodology is then applied to an example system: a Push E-mail service.
The methodology is based on threat and vulnerability analysis, and parallel security requirement and system architecture decomposition.

Original language	English
Title of host publication	Proceedings of the Information Security for South Africa, ISSA 2010
Publisher	IEEE Institute of Electrical and Electronic Engineers
Number of pages	8
ISBN (Electronic)	978-1-4244-5495-2
ISBN (Print)	978-1-4244-5493-8
DOIs	https://doi.org/10.1109/ISSA.2010.5588322
Publication status	Published - 2010
MoE publication type	A4 Article in a conference publication
Event	2011 Conference on Information Security for South Africa, ISSA 2011 - Johannesburg, South Africa Duration: 15 Aug 2011 → 17 Aug 2011

Conference

Conference	2011 Conference on Information Security for South Africa, ISSA 2011
Abbreviated title	ISSA 2011
Country/Territory	South Africa
City	Johannesburg
Period	15/08/11 → 17/08/11

Access to Document

10.1109/ISSA.2010.5588322

Cite this

@inproceedings{e589a47d47dd407ca374e3e01f96d317,

title = "Towards security effectiveness measurement utilizing risk-based security assurance",

abstract = "Systematic and practical approaches to risk-driven operational security evidence help ensure the effectiveness and efficiency of security controls in business-critical applications and services. This paper introduces an enhanced methodology to develop security effectiveness metrics that can be used in connection with correctness assurance of security controls. This methodology is then applied to an example system: a Push E-mail service. The methodology is based on threat and vulnerability analysis, and parallel security requirement and system architecture decomposition.",

author = "Reijo Savola and Heimo Pentik{\"a}inen and Moussa Ouedraogo",

year = "2010",

doi = "10.1109/ISSA.2010.5588322",

language = "English",

isbn = "978-1-4244-5493-8",

booktitle = "Proceedings of the Information Security for South Africa, ISSA 2010",

publisher = "IEEE Institute of Electrical and Electronic Engineers",

address = "United States",

note = "2011 Conference on Information Security for South Africa, ISSA 2011, ISSA 2011 ; Conference date: 15-08-2011 Through 17-08-2011",

}

Savola, R, Pentikäinen, H & Ouedraogo, M 2010, Towards security effectiveness measurement utilizing risk-based security assurance. in Proceedings of the Information Security for South Africa, ISSA 2010 . IEEE Institute of Electrical and Electronic Engineers, 2011 Conference on Information Security for South Africa, ISSA 2011, Johannesburg, South Africa, 15/08/11. https://doi.org/10.1109/ISSA.2010.5588322

Towards security effectiveness measurement utilizing risk-based security assurance. / Savola, Reijo; Pentikäinen, Heimo; Ouedraogo, Moussa.
Proceedings of the Information Security for South Africa, ISSA 2010 . IEEE Institute of Electrical and Electronic Engineers, 2010.

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

TY - GEN

T1 - Towards security effectiveness measurement utilizing risk-based security assurance

AU - Savola, Reijo

AU - Pentikäinen, Heimo

AU - Ouedraogo, Moussa

PY - 2010

Y1 - 2010

N2 - Systematic and practical approaches to risk-driven operational security evidence help ensure the effectiveness and efficiency of security controls in business-critical applications and services. This paper introduces an enhanced methodology to develop security effectiveness metrics that can be used in connection with correctness assurance of security controls. This methodology is then applied to an example system: a Push E-mail service. The methodology is based on threat and vulnerability analysis, and parallel security requirement and system architecture decomposition.

AB - Systematic and practical approaches to risk-driven operational security evidence help ensure the effectiveness and efficiency of security controls in business-critical applications and services. This paper introduces an enhanced methodology to develop security effectiveness metrics that can be used in connection with correctness assurance of security controls. This methodology is then applied to an example system: a Push E-mail service. The methodology is based on threat and vulnerability analysis, and parallel security requirement and system architecture decomposition.

U2 - 10.1109/ISSA.2010.5588322

DO - 10.1109/ISSA.2010.5588322

M3 - Conference article in proceedings

SN - 978-1-4244-5493-8

BT - Proceedings of the Information Security for South Africa, ISSA 2010

PB - IEEE Institute of Electrical and Electronic Engineers

T2 - 2011 Conference on Information Security for South Africa, ISSA 2011

Y2 - 15 August 2011 through 17 August 2011

ER -

Towards security effectiveness measurement utilizing risk-based security assurance

Abstract

Conference

Access to Document

Fingerprint

Cite this