Security-Measurability-Enhancing Mechanisms for a Distributed Adaptive Security Monitoring System

Adaptive security management enables resilience, self-protection and self-healing functionality in business-critical applications, their platforms and networks. Sufficient and credible security evidence gathered from the system and its use forms the basis for adaptive security decision-making. This study proposes practical and systematic security-measurability-enhancing mechanisms that support adaptive and distributed security monitoring of telecommunications and software-intensive systems. The study also analyzes the feasibility of the proposed mechanisms.

[1]  Reijo Savola.  A Security Metrics Taxonomization Model for Software-Intensive Systems , 2009, J. Inf. Process. Syst..

[2]  George Spanoudakis,et al.  Towards security monitoring patterns , 2007, SAC '07.

[3]  Debra Herrmann,et al.  Complete Guide to Security and Privacy Metrics: Measuring Regulatory Compliance, Operational Resilience, and ROI , 2007 .

[4]  Habtamu Abie,et al.  Identification of Basic Measurable Security Components for a Distributed Messaging System , 2009, 2009 Third International Conference on Emerging Security Information, Systems and Technologies.

[5]  Robert A. Martin.  Managing Vulnerabilities in Networked Systems , 2001, Computer.

[6]  Jeff Williams,et al.  A Framework for Reasoning about Assurance April 23 , 1998 Developed for : Document Number : ATR 97043 National Security Agency , 1998 .

[7]  R.A. Martin,et al.  Making security measurable and manageable , 2008, MILCOM 2008 - 2008 IEEE Military Communications Conference.

[8]  E. Ovaska,et al.  From Security Modelling to Run-time Security Monitoring , 2009 .

[9]  Richard Bejtlich,et al.  The Tao of Network Security Monitoring: Beyond Intrusion Detection , 2004 .

[10]  Eugene H. Spafford,et al.  The design and implementation of tripwire: a file system integrity checker , 1994, CCS '94.

[11]  Reijo Savola.  On the Feasibility of Utilizing Security Metrics in Software-Intensive Systems , 2010 .

[12]  Habtamu Abie,et al.  Development of security metrics for a distributed messaging system , 2009, 2009 International Conference on Application of Information and Communication Technologies.

[13]  John Bigham,et al.  GEMOM - Significant and Measurable Progress beyond the State of the Art , 2008, 2008 Third International Conference on Systems and Networks Communications.

[14]  Markus Fiedler,et al.  SecMon: end-to-end quality and security monitoring system , 2008, Ann. UMCS Informatica.

[15]  Karen A. Scarfone,et al.  Guide to Adopting and Using the Security Content Automation Protocol (SCAP) Version 1.0 , 2010 .

[16]  William A. Wulf,et al.  TOWARDS A FRAMEWORK FOR SECURITY MEASUREMENT , 1997 .

[17]  Wayne A. Jansen,et al.  Directions in Security Metrics Research , 2009 .

[18]  Seyed Masoud Sadjadi,et al.  A Survey of Adaptive Middleware , 2003 .

[19]  Reijo Savola,et al.  Development of Measurable Security for a Distributed Messaging System , 2010 .

[20]  Phil Venables.  Security monitoring in heterogeneous globally distributed environments , 1998, Inf. Secur. Tech. Rep..

[21]  Jon Whittle,et al.  A Survey of Approaches to Adaptive Application Security , 2007, International Workshop on Software Engineering for Adaptive and Self-Managing Systems (SEAMS '07).

[22]  Ali R. Hurson,et al.  Boosting-Based Distributed and Adaptive Security-Monitoring through Agent Collaboration , 2007, 2007 IEEE/WIC/ACM International Conferences on Web Intelligence and Intelligent Agent Technology - Workshops.

[23]  Gunnar Peterson,et al.  A Metrics Framework to Drive Application Security Improvement , 2007, IEEE Security & Privacy.

[24]  Reijo Savola,et al.  Definition of Core Requirements and a Reference Architecture for a Dependable, Secure and Adaptive Distributed Monitoring Framework , 2010, 2010 Third International Conference on Dependability.

[25]  Andrew Jaquith.  Security Metrics: Replacing Fear, Uncertainty, and Doubt , 2007 .

[26]  Yoav Tock,et al.  Constructing scalable overlays for pub-sub with many topics , 2007, PODC '07.

[27]  Habtamu Abie,et al.  Robust, Secure, Self-Adaptive and Resilient Messaging Middleware for Business Critical Systems , 2009, 2009 Computation World: Future Computing, Service Computation, Cognitive, Adaptive, Content, Patterns.