Security attribute evaluation method: a cost-benefit approach

ABSTRACT

Conducting cost-benefit analyses of architectural attributes such as security has always been difficult, because the benefits are difficult to assess. Specialists usually make security decisions, but program managers are left wondering whether their investment in security is well spent. This paper summarizes the results of using a cost-benefit analysis method called SAEM to compare alternative security designs in a financial and accounting information system. The case study presented in this paper starts with a multi-attribute risk assessment that results in a prioritized list of risks. Security specialists estimate countermeasure benefits and how the organization's risks are reduced. Using SAEM, security design alternatives are compared with the organization's current selection of security technologies to see if a more cost-effective solution is possible. The goal of using SAEM is to help information-system stakeholders decide whether their security investment is consistent with the expected risks.

REFERENCES

• 1: Ross J. Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, John Wiley & Sons, Inc., New York, NY, 2001
• 2: Butler, Shawn and Fischbeck, Paul. Multi-Attribute Risk Assessment. Technical Report CMU-CS-01-169, December 2001.
• 3: Clemons, Robert T. and Reilly, Terence. Making Hard Decisions. Duxbury, 2001.
• 4: Norman Fenton , Shari Lawrence Pfleeger, Software metrics (2nd ed.): a rigorous and practical approach, PWS Publishing Co., Boston, MA, 1997
• 5: Christopher M. King , Curtis Dalton , Stephen H. Beck, Security Architecture: Design, Deployment, and Operations, McGraw-Hill Professional, 2001
• 6: National Institute of Standards and Technology Special Publications 800-30:Risk Management Guide (DRAFT), June 2001.
• 7: National Institute of Standards and Technology Special Publication 800-14: Generally Accepted Principles and Practices for Securing Information Technology Systems. 1996.
• 8: Yoon, K. Paul and Hwang, Ching-Lai Multiple Attribute Decision Making: An Introduction, Sage Publications, 1995.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.9 Management
          Subjects: Cost estimation

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.3 Software Management
          Subjects: Software process

General Terms:
Algorithms, Design, Security