A propose technical security metrics model for SCADA systems

摘要

Information security metrics are very important to guide the direction for measuring the effectiveness of security controls in compliance with the information security standards. However, lack of method to guide organization in choosing the technical security metrics may cause technical security control objectives and capabilities failed. This research proposes a model of technical security metrics to measure the effectiveness of network security management, such as network security controls and services such as firewall and Intrusion Detection Prevention System (IDPS) in the protection of Supervisory and Data Acquisition (SCADA) systems. The methodology used is Plan-Do-Check-Act process model. The proposed technical security metric provides guidance for SCADA owners in complying with requirements of ISO/IEC 27001 Information Security Management System (ISMS) standard. The proposed model should be able to provide a comprehensive measurement and prove the effectiveness of ISO/IEC 27004 ISMS Measurement standard.