Evidence-Based, Good Enough, and Open

Scarfone, Karen

Conference Paper

Evidence-Based, Good Enough, and Open

Documentation

Published: August 04, 2008

Author(s)

Karen Scarfone

Conference

Name: Third Workshop on Security Metrics (Metricon 3.0)
Dates: July 29, 2008
Location: San Jose, California, United States

Announcement

Abstract

One of the holy grail questions in computer security is how secure are my organization systems? This paper describes our new approach to answering this question. This approach is distinguished from previous efforts in three ways: 1) uses evidence-based security decision-making, 2) produces good enough answers, and 3) relies on open specifications and standards.

Keywords

risk assessment; Security Content Automation Protocol (SCAP); security metrology; technical security metrics

Control Families

None selected

Documentation

Publication:
None available

Supplemental Material:
None available

Document History:
08/04/08: Conference Paper (Final)