Name
Abstract | ||
|---|---|---|
Vulnerabilities in a system may have widely varying impacts on system security. In practice, security should not be defined as the absence of vulnerabilities. In practice, security should not be quantified by the number of vulnerabilities. Security should be managed by pursuing a policy that leads us first to the highest impact vulnerabilities. In light of these observations, we argue in favor of shifting our focus from vulnerability avoidance/removal to measurable security attributes. To this effect, we recommend a logic be used for system security, which captures/represents security properties in quantifiable, verifiable, measurable terms - so that it is possible to reason about security in terms of its observable/ perceptible effects rather than its hypothesized causes. This approach is orthogonal to existing techniques for vulnerability avoidance, removal, detection, and recovery, in the sense that it provides a means to assess, quantify, and combine these techniques. |
Year | DOI | Venue |
|---|---|---|
2011 | 10.1109/HICSS.2011.480 | HICSS |
Keywords | Field | DocType |
system security,varying impact,security attribute,highest impact vulnerability,validating cyber security requirements,case study,perceptible effect,security property,vulnerability avoidance,measurable term,mobile communication,computer security,cyber security,formal verification,availability,certification | Security testing,Vulnerability (computing),Security through obscurity,Asset (computer security),Computer security,Computer science,Vulnerability management,Security information and event management,Countermeasure (computer),Computer security model | Conference |
Citations | PageRank | References |
1 | 0.36 | 12 |
Authors | ||
3 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Robert K. Abercrombie | 1 | 118 | 15.30 |
| Frederick Sheldon | 2 | 86 | 16.46 |
| Ali Mili | 3 | 1067 | 127.61 |