Methodology for Evaluating Security Controls Based on Key Performance Indicators and Stakeholder Mission

Conference · Thu Jan 01 04:00:00 EST 2009

OSTI ID:946487

Sheldon, Frederick T ^[1]; Abercrombie, Robert K ^[1]; Mili, Ali ^[2]

---

1. ORNL
2. New Jersey Insitute of Technology

Information security continues to evolve in response to disruptive changes with a persistent focus on information-centric controls and a healthy debate about balancing endpoint and network protection, with a goal of improved enterprise/business risk management. Economic uncertainty, intensively collaborative styles of work, virtualization, increased outsourcing and ongoing compliance pressures require careful consideration and adaptation. This paper proposes a Cyberspace Security Econometrics System (CSES) that provides a measure (i.e., a quantitative indication) of reliability, performance and/or safety of a system that accounts for the criticality of each requirement as a function of one or more stakeholders interests in that requirement. For a given stakeholder, CSES reflects the variance that may exist among the stakes she/he attaches to meeting each requirement. This paper introduces the basis, objectives and capabilities for the CSES including inputs/outputs as well as the structural and mathematical underpinnings.

• Research Organization: Oak Ridge National Laboratory (ORNL)
• Sponsoring Organization: ORNL work for others
• DOE Contract Number: AC05-00OR22725
• OSTI ID: 946487
• Country of Publication: United States
• Language: English

Related Subjects

97 MATHEMATICS AND COMPUTING
99 GENERAL AND MISCELLANEOUS
COMPUTER NETWORKS
ECONOMETRICS
INFORMATION SYSTEMS
Methodology Cyber Security Performance Indicators Stakeholder Mission Mathematical underpinning
PERFORMANCE
RELIABILITY
SAFETY
SECURITY