Paper proposes a method to elicit security metrics for compliance checks
Original title: Developing Security Metrics for Automated Compliance Checking
An ontology-based data model aims to give metrics a comparable abstraction so they can be combined across a standard.
The paper says automated compliance checking needs prose requirements turned into measurable technical properties, but published metrics lack a systematic elicitation method. The authors define a data model from a systematization of compliance requirements and an ontology for metrics at a comparable abstraction level. They also describe initial open-source work intended to support collaborative metric development.
- Existing metrics overlap and use inconsistent data models and abstraction levels.
- The method is meant to make metrics combinable across a standard's requirements.
- Demonstration is described as initial open-source work.
From the original article
1 min read at arxiv.orgTo automatically check for compliance with security-related standards, prose requirements must be translated to technical properties to make them measurable. A multitude of metrics have been proposed in past literature, but they are lacking a systematic methodology for their elicitation.
By Immanuel Kunz · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.