Designing Sound Security Metrics

This article begins with an introduction to security metrics, describing the need for security metrics, followed by a discussion of the nature of security metrics, including the challenges found with some security metrics used in the past. The article then discusses what makes a sound security metric and proposes a rigorous step-by-step method that can be applied to design sound security metrics, and to test existing security metrics to see if they are sound metrics. This is followed by a discussion of the feasibility of having scientifically-based security metrics and whether or not such metrics are sound. Application examples are included to illustrate the design and testing of sound security metrics.