Validating cyber security requirements: A case study

Document Type

Conference Proceeding

Publication Date

3-28-2011

Abstract

Vulnerabilities in a system may have widely varying impacts on system security. In practice, security should not be defined as the absence of vulnerabilities. In practice, security should not be quantified by the number of vulnerabilities. Security should be managed by pursuing a policy that leads us first to the highest impact vulnerabilities. In light of these observations, we argue in favor of shifting our focus from vulnerability avoidance/removal to measurable security attributes. To this effect, we recommend a logic be used for system security, which captures/represents security properties in quantifiable, verifiable, measurable terms - so that it is possible to reason about security in terms of its observable/perceptible effects rather than its hypothesized causes. This approach is orthogonal to existing techniques for vulnerability avoidance, removal, detection, and recovery, in the sense that it provides a means to assess, quantify, and combine these techniques.

Identifier

79952905805 (Scopus)

ISBN

[9780769542829]

Publication Title

Proceedings of the Annual Hawaii International Conference on System Sciences

External Full Text Location

https://doi.org/10.1109/HICSS.2011.480

ISSN

15301605

This document is currently not available here.

Share

COinS