A Toolkit for Scalable and Automatic Security Analysis Using Security Metrics

Our society has become increasingly dependent on the reliability and proper functioning of a vast number of interconnected information systems. To improve the security of these systems, it is necessary to measure the amount of security provided by different systems and configuration since one cannot improve what cannot be measured. In this proposal, Intelligent Automation Inc. (IAI) and its consultant, Professor Sushil Jajodia from George Mason University, propose to develop a systematic toolkit including security metrics collection, security metrics integration, and data visualization components for scalable and automatic security analysis using security metrics. We will develop a security analysis toolkit using a bottom-up approach.. We first define which security processes, products, services, etc. are in place that can be or already are measured, then consider which meaningful metrics could be derived from those measurements, and finally assess how well those metrics link to objectives for the overall security program.