Security metrics have received significant attention. However, they have not been
systematically explored based on the understanding of attack-defense interactions, which …

This chapter surveys economic approaches for security metrics, among which we could
identify two main areas of research. One has its roots in investment and decision theory and …

Organizations need practical security benchmarking tools in order to plan effective security
strategies. This paper explores a number of techniques that can be used to measure security …

Analyzing security costs Page 1 COMMUNICATIONS OF THE ACM June 2003/Vol. 46, No. 6 15
Costs related to computer security are often difficult to assess, in part because accurate metrics …

Designing an efficient defense framework is challenging with respect to a network's
complexity, widespread sophisticated attacks, attackers' ability, and the diversity of security …

The authors aim to verify the relation between vulnerability and information security
investment. This relation is empirically analyzed using data on e-local governments in …

In recent years, we have seen notable changes in the way attackers infiltrate computer
systems compromising their functionality. Research in intrusion detection systems aims to …

This paper investigates the asymmetric costs of false positive and negative errors to
enhance the IDS performance. The proposed method utilizes the neural network model to …

Information system security risk, defined as the product of the monetary losses associated
with security incidents and the probability that they occur, is a suitable decision criterion …

Conducting a cost-benefit analyses of security solutions has always been hard, because the
benefits are difficult to assess and often only a part of the overall cost is clear. Despite this …