A security metric for assessing the security level of critical infrastructures
by Andrea Tortorelli; Andrea Fiaschetti; Alessandro Giuseppi; Vincenzo Suraci; Roberto Germanà; Francesco Delli Priscoli
International Journal of Critical Computer-Based Systems (IJCCBS), Vol. 10, No. 1, 2020

Abstract: The deep integration between the cyber and physical domains in complex systems make very challenging the security evaluation process, as security itself is more of a concept (i.e., a subjective property) than a quantifiable characteristic. Traditional security assessing mostly relies on the personal skills of security experts, often based on best practices and personal experience. The present work is aimed at defining a security metric allowing evaluators to assess the security level of complex cyber-physical systems (CPSs), as critical infrastructures, in a holistic, consistent and repeatable way. To achieve this result, the mathematical framework provided by the open source security testing methodology manual (OSSTMM) is used as the backbone of the new security metric, since it allows to provide security indicators capturing, in a non-biased way, the security level of a system. Several concepts, as component lifecycle, vulnerability criticality and damage potential - effort ratio are embedded in the new security metric framework, developed in the scope of the H2020 project ATENA.

Online publication date: Fri, 24-Jul-2020

The full text of this article is only available to individual subscribers or to users at subscribing institutions.

 
Existing subscribers:
Go to Inderscience Online Journals to access the Full Text of this article.

Pay per view:
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.

Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Critical Computer-Based Systems (IJCCBS):
Login with your Inderscience username and password:

Username:        Password:          Forgotten your password?

Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable). See our Orders page to subscribe.

If you still need assistance, please email subs@inderscience.com