A Security Metrics Taxonomization Model for Software-Intensive Systems

Abstract: We introduce a novel high-level security metrics objective taxonomization model for soft-ware-intensive systems. The model systematizes and organizes security metrics development activities. It focuses on the security level and security performance of technical systems while taking into account the alignment of metrics objectives with different business and other management goals. The model emphasizes the roles of security-enforcing mechanisms, the overall security quality of the system un-der investigation, and secure system lifecycle, project and business management. Security correctness, effectiveness and efficiency are seen as the fundamental measurement objectives, determining the di-rections for more detailed security metrics development. Integration of the proposed model with risk-driven security metrics development approaches is also discussed. Keywords: Security Metrics, Security Objectives, Tax onomy, Correctness, Effectiveness, Efficiency 1. Introduction The increasing complexity and connectivity of software-intensive systems, products and services are boosting the needs for pertinent and reliable software security and trusted system solutions. Systematic approaches to measur-ing security are needed to obtain evidence of the security level and performance in systems, products and services. In addition, early security evidence will enable cost-effective secure software development. It is easier to make business and engineering decisions concerning security if sufficient and credible evidence of security is available. The field of developing security metrics systematically is young. The complication behind the immaturity of secu-rity metrics is that the current practice of security is still a highly diverse field, and holistic and widely accepted ap-proaches are still missing [1]. , attempts to measure secu-rity have only obtained limited success [2]. Lately, security metrics has become an emerging research area rapidly gaining momentum. The main contribution of this study is to introduce a novel model for security metrics objective taxonomization of technical systems and discuss the motivation for it. The model systematizes and organizes security metrics devel-opment. We analyze the role of different emphasis areas and fundamental measurement objectives and show how the model can be integrated with risk-driven security met-rics development activities. In our model, we have made a premeditated choice not to divide security metrics into technical, operational and organizational metrics, which is the most common classification. The rest of this article is organized in the following way. Section 2 analyzes related work, and Section 3 gives a short introduction to security metrics. Section 4 presents our Security Metrics Objective Segments (SMOS) model, and Section 5 discusses the design of security metrics tax-onomies with the help of the proposed model. Section 6 analyzes how the model can be integrated with the security metrics development process. Section 7 incorporates a dis-cussion on the results and security metrics in general terms, and finally, Section 8 gives conclusions and finalizes the study with some future research questions.