Title: A model for quantitative security measurement and prioritisation of vulnerability mitigation

Authors: Anshu Tripathi; Umesh Kumar Singh

Addresses: Department of Information Technology, Mahakal Institute of Technology, Ujjain 456010, Madhya Pradesh, India ' Institute of Computer Science, Vikram University, Ujjain 456010, Madhya Pradesh, India

Abstract: Quantitative security measurement is an essential step in managing security proactively. This measurement can help system administrator in making optimal decisions about mitigation of security risks posed by presence of vulnerabilities. Quantifying security risks using security metrics is an important and yet challenging task, as metrics exists for individual vulnerabilities but how to aggregate these metrics is still an unresolved issue. In this paper, we propose a quantitative security measurement model that measures security level of hosts in the network by aggregating risk levels of vulnerabilities in a meaningful manner. Further, proposed model guides system administrator in prioritising vulnerability mitigation by evaluating relative risk level of vulnerabilities in the network. Proposed model produces quantitative security metrics that provide rapid and consistent security measurement, hence aid in automated and reasonable security management. A case study is presented to demonstrate the efficacy of proposed model.

Keywords: quantitative security measurements; security metrics; vulnerability mitigation; security risks; risk aggregation; network security; security management.

DOI: 10.1504/IJSN.2013.057696

International Journal of Security and Networks, 2013 Vol.8 No.3, pp.139 - 153

Received: 02 Feb 2013
Accepted: 06 Jun 2013
Published online: 19 Nov 2013 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article