quantitatively measure the performance, dependability, perfomability and security

A unified approach for specifying measures of performance, dependability and performability

--W.H.Sanders

Using some mathematical structure, it is also possible to measure cps security in terms of the amount of "reward(or some other term)" during a specified interval of time, or the rate of accumulation of reward at a specified instant of time or in steady state. It is an evaluation of performance, perfomability based on stochastic activity network model, which could be expanded to security region.

--However, it is hard to understand this reward model, need more thoughts here!

Quantitative Evaluation of Information System Security

--R. Ortalo

This paper first specify the security policy, describe the vulnerability of target system (or organization), and then a quantitative evaluation approach based on the privilege graph model (could be some other model). This method then applied to a security-critical real organization: a medium size bank agency. Also, it is important to illustrate the security measures.

Overall, the goal is to maintain a satisfactory level of security, without impeding the operation of the system. System is still running (well) under malicious attack.

Usual security evaluation methods: evaluation criteria (ITSEC, Information Technology Security Evaluation Criteria, 1991) or risk analysis (Anderson, Comparing Risk Analysis Methodologies, 1991)

Cons: Previous work only focus on the information system design, rather than on the actual system operation (case study).

The method proposed in this paper is also model-based evaluation approach.

1)definition of security policy: security objectives and security rules (specification language)

2)modeling vulnerabilities of the organization, adopted from Dacier and Deswarte, 1994, called a privilege graph. The arcs, the nodes, and the transformation

Using model to quantitatively measure the security of cps for sure would be an promising field. to my best knowledge, I have seen two model, one is use Petri-net with stochastic model, and the other one is use privilege graph. Soon, I will get details for such method and finally come up with my own method.