TOWARDS A FRAMEWORK FOR SECURITY MEASUREMENT

TLDR

Quantifying system security is essential for effective resource allocation, comprehensive understanding, and informed decision‑making, as emphasized by Lord Kelvin’s assertion that measurement yields knowledge, whereas lack of measurement leaves knowledge meager. The study aims to devise a framework for measuring system security, developing the theory and practice of security measurements. The authors propose a framework for measuring system security.

Abstract

This work aims to devise a framework for measuring system security. We can all agree that the ability to compare, to contrast, and to make quantifiable statements about system security is extremely valuable. It means that we will have a basis to determine where to put our limited resources, where to pay attention, and how to best secure our systems. We also believe that one can obtain a more complete and thorough understanding of a subject through measurements that may not otherwise be possible. “When you can measure what you are speaking about and express it in numbers you know something about it,” wrote Lord Kelvin in 1883. “But when you cannot measure it, when you cannot express it in numbers, your knowledge is of a meager and unsatisfactory kind.” This is exactly what motivated our research -to develop the theory and practice of security measurements.