Security concerns simplified into basic building blocks for better knowledge sharing
Atomic Security Concerns: Towards a Foundational Language for Security Knowledge Representation
Cryptography and SecurityComputation and Language
Summary
Cybersecurity covers many ideas like risks, controls, and rules, but these ideas are often described differently, making it hard to connect them all. The authors suggest thinking of cybersecurity concepts as combinations of simpler basic parts called Atomic Security Concerns, similar to how everything in chemistry is made of atoms. This idea could help create a common language to clearly explain and work with security concepts across various areas. The work is a starting point for future studies to build a unified way to represent and reason about cybersecurity knowledge.
What this means in practice
- •For security governance teams: Create clearer communications and documentation by representing security policies as sets of fundamental concerns.
- •For compliance auditors: Develop checklists and compliance frameworks using a common abstraction layer that links diverse regulatory requirements.
A position paper. It proposes an approach and reports no results.
Authors
Hanane Houmani
Abstract
Cybersecurity governance, risk management, compliance, and security architecture rely on numerous concepts, including security properties, domains, controls, risks, implementation measures, capabilities, and compliance requirements. Although these concepts are widely used, they are often represented through heterogeneous abstractions and vocabularies, making relationships among them difficult to express consistently and leaving much of the associated reasoning dependent on expert knowledge. This paper introduces the concepts of Security Concerns and Atomic Security Concerns (ASCs) and explores the hypothesis that cybersecurity knowledge may be represented through a finite set of foundational concerns. Inspired by the role of atoms in chemistry, the proposed approach views cybersecurity concepts as compositions of more fundamental concerns rather than as independent abstractions. Hence, Atomic Security Concerns could be viewed as a common abstraction layer for the representation of cybersecurity concepts, independently of their domain, nature, or level of granularity. Building upon this perspective, the paper explores how Atomic Security Concerns may provide the vocabulary of a cybersecurity language and how cybersecurity concepts may be represented as concern sets supporting explicit relationships among concepts. The contribution of this work is intentionally conceptual: it introduces a framework and research hypothesis for investigating the foundations of a common language for cybersecurity knowledge representation, reasoning, and future formalization.