Abstract:Metrics and frameworks to quantifiably assess security measures have arisen from needs of three distinct research communities - statistical measures from the intrusion detection and prevention literature, evaluation of cyber exercises, e.g.,red-team and capture-the-flag competitions, and economic analyses addressing cost-versus-security tradeoffs. In this paper we provide two primary contributions to the security evaluation literature - a representative survey, and a novel framework for evaluating security that is flexible, applicable to all three use cases, and readily interpretable. In our survey of the literature we identify the distinct themes from each community's evaluation procedures side by side and flesh out the drawbacks and benefits of each. The evaluation framework we propose includes comprehensively modeling the resource, labor, and attack costs in dollars incurred based on expected resource usage, accuracy metrics, and time. This framework provides a unified approach in that it incorporates the accuracy and performance metrics, which dominate intrusion detection evaluation, the time to detection and impact to data and resources of an attack, favored by educational competitions' metrics, and the monetary cost of many essential security components used in financial analysis. Moreover, it is flexible enough to accommodate each use case, easily interpretable and comparable, and comprehensive in terms of costs <a class="link-external link-http" href="http://considered.Finally" rel="external noopener nofollow">this http URL</a>, we provide two examples of the framework applied to real-world use cases. Overall, we provide a survey and a grounded, flexible framework with multiple concrete examples for evaluating security which can address the needs of three currently distinct communities.

Quantitatively Measure Access Control Mechanisms across Different Operating Systems

Evaluating and Comparing the Quality of Access Control in Different Operating Systems.

AADL Vulnerability Modeling and Security Analysis Method

Access Control of Secure Operating System for Electronic Government Application

An improved mechanism of authorization control based on Web environment

Integrated quantitative assessment of mainstream operating systems' security vulnerabilities

Mitigating Access Control Vulnerabilities through Interactive Static Analysis.

ACPT: A Tool for Modeling and Verifying Access Control Policies

Intrusion Alerts Correlation Based Assessment of Network Security

Study of Test Approach on Access Control

Modeling, Implementation and Application of Extensible Access Control

Multiple-implementation testing for XACML implementations.

Study and Improvement of MAC(Mandatory Access Control) for Windows

Towards accuracy of role-based access control configurations in component-based systems

Quantifying the Effects of Operational Technology or Industrial Control System based Cybersecurity Controls via CVSS Scoring

Specify and Enforce the Policies of Quantified Risk Adaptive Access Control

Quantifiable & Comparable Evaluations of Cyber Defensive Capabilities: A Survey & Novel, Unified Approach

An OS Security Protection Model for Defeating Attacks from Network

Arm up Administrators: Automated Vulnerability Management

Conformance Checking of Access Control Policies Specified in XACML

Toward Systematic Testing of Access Control Policies