A Risk Based Approach for Security Assurance Evaluation of IT Systems

Abstract

Research literature has argued the need for a methodology to measure security assurance levels of a system as vital in order to maintain and improve the overall system security. This paper proposes a risk-based security assurance metric and aggregation techniques to be incorporated in a methodology for the evaluation of IT systems security assurance.