Towards a taxonomy for information security metrics

Systematic approaches to measuring security are needed in order to obtain evidence of the security performance of products or an organization. In this study we survey the emerging security metrics approaches from the academic, governmental and industrial perspectives and aim to bridge the gap between information security management and Information and Communication Technology (ICT) product security practices. If common metrics approaches between different security disciplines can be found, this will advance our holistic understanding and capabilities, both in management and engineering practices. Categories and Subject Descriptors D.2.8 [Software Engineering]: Metrics – process metrics, product metrics. General Terms Management, Measurement, Security. Keywords Information security metrics, security assurance, information assurance, software security, network security.

• Type: Conference
• Year: 2007
• Where: CCS
• Authors: Reijo Savola
• Keywords: CCS 2007, Metrics Approaches, Security, Security Metrics, Security Privacy