Security metrics have received significant attention. However, they have not been
systematically explored based on the understanding of attack-defense interactions, which …

Information security metrics are seen as an important factor in making sound decisions
about various aspects of security, ranging from the design of security architectures and …

The pressure is on. Various surveys indicate that over the past several years computer
security has risen in priority for many organizations. Spending on IT security has increased …

The Common Vulnerability Scoring System (CVSS) is a widely used and well-established
standard for classifying the severity of security vulnerabilities. For instance, all vulnerabilities …

To provide insight on system security and aid decision-makers, we propose the ADversary
VIew Security Evaluation (ADVISE) method to quantitatively evaluate the strength of a …

Abstract System security assurance provides the confidence that security features, practices,
procedures, and architecture of software systems mediate and enforce the security policy …

Systematic approaches to measuring security are needed in order to obtain evidence of the
security performance of products or an organization. In this study we survey the emerging …

Security assessment of a system is a difficult problem. Most of the current efforts in security
assessment involve searching for known vulnerabilities. Finding unknown vulnerabilities still …

We propose a metric to determine whether one version of a system is relatively more secure
than another with respect to the system's attack surface. Intuitively, the more exposed the …

The increasing complexity of today's computer systems, together with the rapid emergence
of novel vulnerabilities, make security hardening a formidable challenge for security …