Towards security evaluation based on evidence collection

Reijo Savola

Towards security evaluation based on evidence collection

Research output: Chapter in Book/Report/Conference proceeding › Conference article in proceedings › Scientific › peer-review

2 Citations (Scopus)

Abstract

Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. Here we introduce a general-level holistic framework for security evaluation based on security behaviour modelling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation setups in real-world systems.

Original language	English
Title of host publication	Proceedings of the ISSA 2006 from Insight to Foresight Conference
Editors	Jan H. P. Eloff, Les Labuschagne, Mariki M. Eloff, Hein S. Venter
Number of pages	10
Publication status	Published - 2006
MoE publication type	A4 Article in a conference publication
Event	6th Information Security South Africa Conference, ISSA 2006 : From Insight to Foresight - Sandton, South Africa Duration: 5 Jul 2006 → 7 Jul 2006 Conference number: 6

Conference

Conference	6th Information Security South Africa Conference, ISSA 2006
Abbreviated title	ISSA 2006
Country	South Africa
City	Sandton
Period	5/07/06 → 7/07/06

Fingerprint

Cite this

Savola, R. (2006). Towards security evaluation based on evidence collection. In J. H. P. Eloff, L. Labuschagne, M. M. Eloff, & H. S. Venter (Eds.), Proceedings of the ISSA 2006 from Insight to Foresight Conference https://digifors.cs.up.ac.za/issa/2006/Proceedings/Full/10_Paper.pdf

@inproceedings{2f1adf7471e544aeaeb6a615c4f6b26d,

title = "Towards security evaluation based on evidence collection",

abstract = "Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. Here we introduce a general-level holistic framework for security evaluation based on security behaviour modelling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation setups in real-world systems.",

author = "Reijo Savola",

year = "2006",

language = "English",

isbn = "1-86854-636-5",

editor = "Eloff, {Jan H. P.} and Les Labuschagne and Eloff, {Mariki M.} and Venter, {Hein S.}",

booktitle = "Proceedings of the ISSA 2006 from Insight to Foresight Conference",

note = "6th Information Security South Africa Conference, ISSA 2006 : From Insight to Foresight, ISSA 2006 ; Conference date: 05-07-2006 Through 07-07-2006",

}

TY - GEN

T1 - Towards security evaluation based on evidence collection

AU - Savola, Reijo

N1 - Conference code: 6

PY - 2006

Y1 - 2006

N2 - Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. Here we introduce a general-level holistic framework for security evaluation based on security behaviour modelling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation setups in real-world systems.

AB - Information security evaluation of software-intensive systems typically relies heavily on the experience of the security professionals. Obviously, automated approaches are needed in this field. Unfortunately, there is no practical approach to carrying out security evaluation in a systematic way. Here we introduce a general-level holistic framework for security evaluation based on security behaviour modelling and security evidence collection, and discuss its applicability to the design of security evaluation experimentation setups in real-world systems.

M3 - Conference article in proceedings

SN - 1-86854-636-5

BT - Proceedings of the ISSA 2006 from Insight to Foresight Conference

A2 - Eloff, Jan H. P.

A2 - Labuschagne, Les

A2 - Eloff, Mariki M.

A2 - Venter, Hein S.

T2 - 6th Information Security South Africa Conference, ISSA 2006

Y2 - 5 July 2006 through 7 July 2006

ER -

Access to Document

https://digifors.cs.up.ac.za/issa/2006/Proceedings/Full/10_Paper.pdf