Defining and Computing a Valued Based Cyber-Security Measure

Journal Article · Sun Jan 01 00:00:00 EST 2012 · Information Systems and e-Business Management

DOI:https://doi.org/10.1007/s10257-011-0177-1· OSTI ID:1057509

Aissa, Anis Ben ^[1]; Abercrombie, Robert K ^[2]; Sheldon, Frederick T ^[2]; Mili, Ali ^[3]

---

1. University of Tunis, Belvedere, Tunisia
2. ORNL
3. New Jersey Insitute of Technology

In earlier work, we presented a value based measure of cybersecurity that quantifies the security of a system in concrete terms, specifically, in terms of how much each system stakeholder stands to lose (in dollars per hour of operation) as a result of security threats and system vulnerabilities; our metric varies according to the stakes that each stakeholder has in meeting each security requirement. In this paper, we discuss the specification and design of a system that collects, updates, and maintains all the information that pertains to estimating our cybersecurity measure, and offers stakeholders quantitative means to make security-related decisions.

• Research Organization: Oak Ridge National Lab. (ORNL), Oak Ridge, TN (United States)
• Sponsoring Organization: USDOE
• DOE Contract Number: DE-AC05-00OR22725
• OSTI ID: 1057509
• Journal Information: Information Systems and e-Business Management, Vol. 10, Issue 4; ISSN 1617--9846
• Country of Publication: United States
• Language: English

Related Subjects

Cyber security metrics
Risk management
Information security
Algorithms
Measurement
Performance
Design
Economics
Reliability
Experimentation
Security
Theory
Verification