![](bg6.png)
extracted from this first classification, and to further analyze the tendencies in the time
for the proposition of new metrics.
We also want to start analyzing the relative importance among those metrics for the
attainment of the objectives of security. In this way, additional approaches will be used
to prioritize the use of metrics. We also want to analyze the difficulty in the obtaining of
the metric ones or in their use to guide in the modification of those metrics to be more
useful.
The characterization of security metrics proposed is not complete because some
metrics are the same values for all features. A future work is to refine this characteriza-
tion so that each metric is different in the classification.
Finally, indicators should be defined in function of the size of the organization and
sector (for example, public sector and private sector) because it is not realistic to have
a good group of metrics which are useful for all the organizations.
References
1. Mercuri, R.T.: Analyzing security costs. Communications of the ACM 46 (2003) 15–18
2. Swanson, M., Bartol, N., Sabato, J., Hash, .J., Graffo, L.: Security metrics guide for infor-
mation technology systems. Technical Report NIST 800-55, National Institute of Standards
and Technology (2003)
3. Vaughn, Jr., R.B., Henning, R., Siraj, A.: Information assurance measures and metrics -
state of practice and proposed taxonomy. In: Proceedings of the 36th Hawaii International
Conference on Systems Sciences. (2003)
4. Bouvier, P., Longeon, R.: Le tableau de bord de la s
´
ecurit
´
e du syst
`
eme d’information.
S
´
ecurit
´
e Informatique (2003)
5. Nielsen, F.: Approaches of security metrics. Technical report, NIST-CSSPAB (2000)
6. Payne, S.C.: A guide to security metrics. Technical report, SANS Institute (2001)
7. ACSA, ed.: Proceedings of the Workshop on Information Security System Scoring and
Ranking, Williamsburg, Virginia (2001)
8. Colado, C., Franco, A.: M
´
etricas de seguridad: una visi
´
on actualizada. SIC. Seguridad en
Inform
´
atica y Comunicaciones 57 (2003) 64–66
9. Swanson, M.: Security self-assessment guide for information technology systems. Technical
Report NIST 800-26, National Institute of Standards and Technology (2001)
10. Calero, C., Mart
´
ın-Albo, J., Piattini, M., Vallecillo, M.B..A., Cechich, A.: A survey on
software component metrics. Submitted to ACM Computing Surveys (2003)
11. Fenton, N., Pfleeger, S.: Software Metrics: A Rigorous Approach. 2nd edn. Chapman Hall,
London (1997)
12. Whitmire, S.: Object Oriented Design Measurement. Wiley, New York (1997)
13. Zuse, H.: A Framework of Software Measurement. Walter de Gruyter, Berlin (1998)
14. Poels, G., Dedene, G.: Distance-based software measurement: Necessary and sufficient prop-
erties for software measures. Information and Software Technology 42 (2000) 35–46
15. Weyuker, E.J.: Evaluating software complexity measures. IEEE Transactions on Software
Engineering 14 (1988) 1357–1365
16. Briand, L.C., Morasca, S., Basili, V.R.: Property-based software engineering measurement.
IEEE Transactions on Software Engineering 22 (1996) 68–86
17. Briand, L.C., Morasca, S., Basili, V.R.: Property-based software engineering measurement:
Refining the additivity properties. IEEE Transactions on Software Engineering 23 (1997)
196–197
347