Ontologies for modeling enterprise level security metrics

Currently, it is difficult to answer simple questions such as "are we more secure than yesterday" or "how should we invest our limited security budget." Decision makers in other areas of business and engineering often use metrics for determining whether a projected return on investment justifies its costs. Spending for new cyber-security measures is such an investment. Therefore, security metrics [1] that can quantify the overall risk in an enterprise system are essential in making sensible decisions in security management.