Environment Characterization and System Modeling Approach for the Quantitative Evaluation of Security

  • Geraldine Vache
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5775)


This article aims at proposing a new approach for the quantitative evaluation of information system security. Our approach focuses on system vulnerabilities caused by design and implementation errors and studies how system environment, considering such vulnerabilities, may endanger the system. The two main contributions of this paper are: 1) the identification of the environmental factors which influence the security system state; 2) the development a Stochastic Activity Network model taking into account the system and these environmental factors. Measures resulting from our modeling are aimed at helping the system designers in the assessment of vulnerability exploitation risks.


Input Gate Patch Application Attack Graph Environment Characterization Information System Security 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    U.S. Department of Defence Trusted Computer Security Evaluation Criteria (1985)Google Scholar
  2. 2.
    European Communities, Information Technology Security Evaluation Criteria (1991)Google Scholar
  3. 3.
    Common Criteria for Information Technology Security Evaluation (1996) Google Scholar
  4. 4.
    ISO/IEC 27001:2005, Requirements for Information security management systems (2005)Google Scholar
  5. 5.
    ISO/IEC 27002:2005, Code of practice for information security management (2005)Google Scholar
  6. 6.
    Jaquith, A.: Security metrics-Replacing fear, uncertainty, and doubt. Addison Wesley Professional, Reading (2007)Google Scholar
  7. 7.
    Laprie, J., Arlat, J., Blanquart, J., Costes, A., Deswarte, Y., Fabre, J., Guillermain, H., Kaâniche, M., Kanoun, K., Mazet, C., Powell, D., Rabéjac, C., Thévenod, P.: Guide de la Sûreté de Fonctionnement, Cépaduès (1995)Google Scholar
  8. 8.
    Brocklehurst, S., Littlewood, B., Olovsson, T., Jonsson, E.: On measurement of operational security. Aerospace and Electronic Systems Magazine, IEEE 9, 7–16 (1994)CrossRefGoogle Scholar
  9. 9.
    Dacier, M.: Vers une évaluation quantitative de la sécurité informatique, Thèse de doctorat LAAS-CNRS (1994) (in french)Google Scholar
  10. 10.
    Dacier, M., Deswarte, Y., Kaâniche, M.: Quantitative assessment of operational security: models and tools. CNRS-LAAS (1996)Google Scholar
  11. 11.
    Ortalo, R., Deswarte, Y., Kaaniche, M.: Experimenting with quantitative evaluation tools for monitoring operational security. IEEE Transactions on Software Engineering 25, 633–650 (1999)CrossRefGoogle Scholar
  12. 12.
    Sheyner, O.M.: Scenario Graphs and Attack Graphs, PhD Thesis, Carnegie Mellon University, Pittsburgh, PA (2004)Google Scholar
  13. 13.
    Jha, S., Sheyner, O., Wing, J.: Two formal analyses of attack graphs. In: Proceedings of 15th IEEE Computer Security Foundations Workshop, 2002, pp. 49–63 (2002)Google Scholar
  14. 14.
    Swiler, L., Phillips, C., Ellis, D., Chakerian, S.: Computer-attack graph generation tool. In: Proceedings of DARPA Information Survivability Conference & Exposition II, DISCEX 2001, vol. 2, pp. 307–321 (2001)Google Scholar
  15. 15.
    Balzarotti, D., Monga, M., Sicari, S.: Assessing the risk of using vulnerable component, Quality of Protection, pp. 65–77. Springer, Heidelberg (2006)Google Scholar
  16. 16.
    McQueen, M.A., Boyer, W.F., Flynn, M.A., Beitel, G.A.: Time-to-Compromise model for cyber risk reduction estimation, Quality of Protection, pp. 49–64. Springer, Heidelberg (2006)Google Scholar
  17. 17.
    Mell, P., Scarfone, K., Romanovsky, S.: CVSS v2 Complete Documentation. ccvs (June 2007)Google Scholar
  18. 18.
    Frei, S., May, M., Fiedler, U., Plattner, B.: Large-scale vulnerability analysis. In: Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense, Pisa, Italy, pp. 131–138. ACM, New York (2006)CrossRefGoogle Scholar
  19. 19.
    Jones, J.R.: Estimating Software Vulnerabilities. IEEE Security and Privacy 5, 28–32 (2007)CrossRefGoogle Scholar
  20. 20.
    CVE - Common Vulnerabilities and Exposures (CVE),
  21. 21.
  22. 22.
    MAFTIA Consortium, Conceptual Model and Architecture of MAFTIA, MAFTIA (Malicious and Accidental Fault Tolerance for Internet Applications) project deliverable D21, LAAS-CNRS Report 03011 (1993)Google Scholar
  23. 23.
    Frei, S.: 0-day patch - Exposing vendors (In)security Performance, Amsterdam, NLGoogle Scholar
  24. 24.
    Fischbach, N.: Le cycle de vie d’une vulnérabilité (2003) (in french)Google Scholar
  25. 25.
    Microsoft Security Bulletin MS02-039 Google Scholar
  26. 26.
    Computer Security Research - McAfee Avert Labs Blog Google Scholar
  27. 27.
    Vache, G.: Towards Information System Security Metrics. In: Proceedings of Seventh European Dependable Computing Conference, Kaunas, Lithuania, pp. 41–44 (2008)Google Scholar
  28. 28.
    Sanders, W.H., Meyer, J.F.: Stochastic Activity Networks: Formal definitions and concepts. Lectures on Formal Methods and Performance Analysis, pp. 315–343. Springer, Heidelberg (2001)zbMATHGoogle Scholar
  29. 29.
    Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the Slammer worm. Security & Privacy 1, 33–39 (2003)CrossRefGoogle Scholar
  30. 30.
  31. 31.
    The Mobiüs Tool,

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Geraldine Vache
    • 1
    • 2
  1. 1.CNRS; LAAS; Université de ToulouseToulouseFrance
  2. 2.Université de Toulouse ; UPS, INSA, INP ; LAAS ToulouseFrance

Personalised recommendations