The Relative Security Metric of Information Systems: Using AIMD algorithms.

摘要

Security metrics are required to provide a quantitative and objective basis for security operations. The quantitative and objective basis is needed to support decision making, quality assurance of Information Technology (IT) products, and the reliable maintenance of the information systems and its operations. There had been numerous ways of quantifying the security metrics of information system using Common Vulnerability Scoring System, version 2.0 (CVSS 2.0) of the products that make up the information system. Some of the approaches are the naive (average and maximum) approach, attack graph approach and Bayesian network (BN)-Based approach but this paper will introduce another way of finding the relative security metrics of information system based on the CVSS 2.0 score of the IT products that make up the system. This new approach is called Additive Increase and Multiplicative Decrease (AIMD) and this paper will also show how to use the AIMD algorithm to determine the security states and the security signature of the IT product.