Defining and computing a value based cyber-security measure

Anis Ben Aissa; Robert K. Abercrombie; Frederick T. Sheldon; Ali Mili

doi:10.1145/2107556.2107561

Defining and computing a value based cyber-security measure

Anis Ben Aissa, Robert K. Abercrombie, Frederick T. Sheldon, Ali Mili

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

In past work[1,3,4], we presented a value based measure of cybersecurity that quantifies the security of a system in concrete terms, specifically, in terms of how much each system stakeholder stands to lose (in dollars per hour of operation) as a result of security threats and system vulnerabilities\; our metric varies according to the stakes that each stakeholder has in meeting each security requirement. In this paper we discuss the specification and design of a system that collects, updates and maintains all the information that pertains to estimating our cybersecurity measure, and offers stakeholders quantitative means to make security-related decisions.

Original language	English (US)
Title of host publication	Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11
DOIs	https://doi.org/10.1145/2107556.2107561
State	Published - 2011
Event	2nd Kuwait Conference on e-Services and e-Systems, KCESS'11 - Kuwait City, Kuwait Duration: Apr 5 2011 → Apr 7 2011

Publication series

Name	Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11

Other

Other	2nd Kuwait Conference on e-Services and e-Systems, KCESS'11
Country/Territory	Kuwait
City	Kuwait City
Period	4/5/11 → 4/7/11

All Science Journal Classification (ASJC) codes

Computer Networks and Communications
Information Systems

Keywords

Cyber security metrics
Information security
Risk management

Access to Document

10.1145/2107556.2107561

Cite this

@inproceedings{29d39f60227c45079dd5df172f366057,

title = "Defining and computing a value based cyber-security measure",

abstract = "In past work[1,3,4], we presented a value based measure of cybersecurity that quantifies the security of a system in concrete terms, specifically, in terms of how much each system stakeholder stands to lose (in dollars per hour of operation) as a result of security threats and system vulnerabilities\; our metric varies according to the stakes that each stakeholder has in meeting each security requirement. In this paper we discuss the specification and design of a system that collects, updates and maintains all the information that pertains to estimating our cybersecurity measure, and offers stakeholders quantitative means to make security-related decisions.",

keywords = "Cyber security metrics, Information security, Risk management",

author = "Aissa, {Anis Ben} and Abercrombie, {Robert K.} and Sheldon, {Frederick T.} and Ali Mili",

year = "2011",

doi = "10.1145/2107556.2107561",

language = "English (US)",

isbn = "9781450307932",

series = "Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11",

booktitle = "Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11",

note = "2nd Kuwait Conference on e-Services and e-Systems, KCESS'11 ; Conference date: 05-04-2011 Through 07-04-2011",

}

Aissa, AB, Abercrombie, RK, Sheldon, FT & Mili, A 2011, Defining and computing a value based cyber-security measure. in Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11., 5, Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11, 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11, Kuwait City, Kuwait, 4/5/11. https://doi.org/10.1145/2107556.2107561

Defining and computing a value based cyber-security measure. / Aissa, Anis Ben; Abercrombie, Robert K.; Sheldon, Frederick T. et al.
Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11. 2011. 5 (Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Defining and computing a value based cyber-security measure

AU - Aissa, Anis Ben

AU - Abercrombie, Robert K.

AU - Sheldon, Frederick T.

AU - Mili, Ali

PY - 2011

Y1 - 2011

N2 - In past work[1,3,4], we presented a value based measure of cybersecurity that quantifies the security of a system in concrete terms, specifically, in terms of how much each system stakeholder stands to lose (in dollars per hour of operation) as a result of security threats and system vulnerabilities\; our metric varies according to the stakes that each stakeholder has in meeting each security requirement. In this paper we discuss the specification and design of a system that collects, updates and maintains all the information that pertains to estimating our cybersecurity measure, and offers stakeholders quantitative means to make security-related decisions.

AB - In past work[1,3,4], we presented a value based measure of cybersecurity that quantifies the security of a system in concrete terms, specifically, in terms of how much each system stakeholder stands to lose (in dollars per hour of operation) as a result of security threats and system vulnerabilities\; our metric varies according to the stakes that each stakeholder has in meeting each security requirement. In this paper we discuss the specification and design of a system that collects, updates and maintains all the information that pertains to estimating our cybersecurity measure, and offers stakeholders quantitative means to make security-related decisions.

KW - Cyber security metrics

KW - Information security

KW - Risk management

UR - http://www.scopus.com/inward/record.url?scp=84857970380&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=84857970380&partnerID=8YFLogxK

U2 - 10.1145/2107556.2107561

DO - 10.1145/2107556.2107561

M3 - Conference contribution

AN - SCOPUS:84857970380

SN - 9781450307932

T3 - Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11

BT - Proceedings of the 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11

T2 - 2nd Kuwait Conference on e-Services and e-Systems, KCESS'11

Y2 - 5 April 2011 through 7 April 2011

ER -

Defining and computing a value based cyber-security measure

Abstract

Publication series

Other

All Science Journal Classification (ASJC) codes

Keywords

Access to Document

Other files and links

Fingerprint

Cite this