Security metrics method aids automatic compliance with standards
Developing Security Metrics for Automated Compliance Checking
Cryptography and Security
Summary
Checking if computer systems follow security rules can be hard because the rules are written in plain language and not directly measurable. The authors created a way to turn these rules into clear, measurable security metrics using a structured data model and an ontology. This helps make sure the metrics are consistent and can work together to cover all parts of a standard. They also started an open-source project to let people work together on creating these metrics.
What this means in practice
- •For security compliance teams: Automatically measure if organizational IT systems follow required security standards with consistent, interoperable metrics generated from prose requirements.
- •For software development teams: Integrate systematic security metric generation into automated tools to ensure new software meets security compliance during development and testing.
Authors
Immanuel Kunz, Nico Haas, Angelika Schneider, Christian Banse
Abstract
To automatically check for compliance with security-related standards, prose requirements must be translated to technical properties to make them measurable. A multitude of metrics have been proposed in past literature, but they are lacking a systematic methodology for their elicitation. Without such a methodology, metrics remain inconsistent in their data models and abstraction levels, they exhibit considerable overlaps and are difficult to combine to comprehensively cover a standard's requirement. In this paper, we develop a data model for security metrics based on a systematization of compliance requirements, and we propose a methodology for their elicitation. The method is based on an ontology that enables a systematic development of metrics with a comparable degree of abstraction. We also present our initial work on an open-source effort that demonstrates that our approach also supports a collaborative development of metrics.