System architects need quantitative security metrics to make informed trade-off decisions
involving system security. The security metrics need to provide insight on weak points in the …

Software vulnerabilities represent a major cause of cyber-security problems. The National
Vulnerability Database (NVD) is a public data source that maintains standardized …

A majority of attacks on computer systems result from a combination of vulnerabilities
exploited by an intruder to break into the system. An Attack Graph is a general formalism …

We develop formal techniques that give users flexibility in examining design errors
discovered by automated analysis. We build our results using the model checking approach …

The smart grid's heavy reliance on cyber resources introduces numerous security concerns.
The substantial attack surface presented by the advanced metering infrastructure (AMI) …

While computer vulnerabilities have been continually reported in laundry-list format by most
commercial scanners, a comprehensive network vulnerability assessment has been an …

Network security metrics (NSMs) based on models allow to quantitatively evaluate the
overall resilience of networked systems against attacks. For that reason, such metrics are of …

Quantifying security risk is an important and yet difficult task in enterprise network security
management. While metrics exist for individual software vulnerabilities, there is currently no …

We propose a new model for estimating the time to compromise a system component that is
visible to an attacker. The model provides an estimate of the expected value of the time-to …

This paper presents and discusses the current state of Graphical Security Models (GrSM), in
terms of four GrSM phases:(i) generation,(ii) representation,(iii) evaluation, and (iv) …