SECURATE - Security evaluation and analysis using fuzzy metrics

In the last several years, methods for controlling security in computer systems have become widely known. While in 1972 there were only one or two books and three bibliographies on computer security and privacy, in 1977 there were at least 15 books and six bibliographies on the topic. Expanding public concern with the problem is evidenced by a great deal of federal, state and local legislation.1,2 Governmental agencies such as the National Bureau of Standards, the Defense Department, and the National Science Foundation are all sponsoring research efforts in the area, as have some private manufacturers. 3-5 One consequence of this work is that a significant part of the computing community is now aware of techniques 6 for . maintaining security in computer systems. Unfortunately, the question of how to measure the costs and effectiveness of the various security methods is still largely unexplored. Only recently has there been any reliable work done on costs of privacy transformations or authentication methods, and researchers have only scratched the surface in investigating metrics for security systems. 7 While some more formal work has begun,8-13 there has so far been very little useful application of this theoretical work to practical security decisions. One exception is a privacy cost model which has been recently introduced. 14 This work assesses the impact of various privacy regulations upon data processing installations which handle personal information. Goldstein discusses conversion costs to meet privacy requirements and the "privacy increment" to installation op-