![](bg7.png)
the user/operators monitor should be secured and
resilient. Similarly, access to the Security Assurance
evaluation system should be controlled. A lack of
stringent security could in fact result in a malicious
individual gaining information related to the systems
security and enable him/her
to wait for an auspicious time to launch an attack.
Alternatively the communication links between a
user/operators monitor and the evaluation system on
the one hand, or between entities within the
evaluation framework itself on the other hand, may
accidentally break leading to security information
black outs.
On top of probing the deployed security, work
relating the systematic verification of security
policies as another facet of the broader SA
assessment initiative is highly important and
requires the attention of researchers. In fact the
current indicators provided by the SA tool remains
as reliable as the security policy since the
verifications are conducted taking the later as
reference. Thus, because a policy can also be the
source of security compromise and a vector for
further propagation of a risk within a network,
considering it as appropriate without further checks
can only provide partial assurance to the system’s
stakeholders. One way of accounting for the
adequacy of policy, which we are currently
exploring includes the use of satisfiability tests with
conducted by a logic reasoner that will verify
whether known attack patterns can be deduced from
the policy specification. Finally by providing
indicator on the status of a security matter that is
often devolved to the provider as it is the case in the
cloud, the SA tool can be used as a means of
fostering better security transparency between a
cloud provider and client.
Our SA assurance tool has a Security Content
and Automation Protocol or SCAP capability though
currently our checklist related to the security
mechanisms is based on instructions and check list
derived from reference documents such as security
policies that are subsequently put in an XML-based
format. The adoption of the XCCDF format is
therefore planned to allow it being more compatible
with other SCAP tools and thus leading to a standard
information interchange, document generation,
automated compliance testing, and scoring.
7 CONCLUSION AND FUTURE
WORK
In this article we have discussed the challenges
relating the evaluation of SA and presented the
features of our SA evaluation tool. We have also
advocated the use of such a system to better manage
security of IT systems. Certainly, addressing SA at
the level of operational systems is only one facet of
security management. Other important aspects
include: the selection of the security mechanisms;
their strength and that of the security policy.
Nonetheless, without adoption of a rigorous and
continuous Security Assurance activity it is hardly
possible to guarantee and maintain security
regardless of the security level aimed at.
ACKNOWLEDGEMENTS
This work has been conducted in the context of the
SAINTS project, financed by the national fund of
research of the Grand Duchy of Luxembourg (FNR)
under grant number C12/IS/3988336.
REFERENCES
Arbaugh W.A. and Frincke, D.A, 2011. Living with
insecurity.” IEEE Security & Privacy, vol. 9, no. 6, pp.
12–13.
Chew, E, Swanson, M ,Stine, K., Bartol, N., Brown A.,
and Robinson, W, 2008. Security metrics guide for
information technology systems rev.1, Nist special
publication 800-55: National Institute of Standards
and Technology, Tech. Rep., 2008.
Contreras J. L, DeNardis, L. and Teplinsky, M, 2013.
Mapping today’s cybersecurity landscape,” American
University Law Review, vol. 62, no. 5, p. 1117.
DHS, 2014. National cyber security awareness month.
[Online]. Available:https://www.dhs.gov/national-
cyber-security- awareness-month
ENISA, 2014. European cyber security month. [Online].
Available: https://cybersecuritymonth.eu/
ISO/IEC (2009 ), ISO/IEC 15408-1:2009, International
Organization for Standardization and the International
Electrotechnical Commission, Geneva.
Furnell S.M. (2009) ‘The irreversible march of
technology’, Information Security Technical Report
14(4)pp.176-180, Elsevier.
Hecker A. and Riguidel, M. 2009. On the operational
security assurance evaluation of networked it
systems,” in Smart Spaces and Next Generation
Wired/Wireless Networking. Springer, pp. 266–278.
Kanstren, T., Savola R. , Evesti, A., Pentikäinen, H.,
Hecker, A., Ouedraogo, M. , Hatonen, K., Halonen
P., Blad, C., Lopez O. 2010. Towards an abstraction
layer for security assurance measurements, in
Proceedings of the Fourth European Conference on
Software Architecture: Companion Volume. ACM,
2010, pp. 189–196.
SECRYPT2014-InternationalConferenceonSecurityandCryptography
482