Towards measurement of security effectiveness enabling factors in software intensive systems

Adequate information security effectiveness during system operation is the ultimate goal of all security solutions for software-intensive systems. Sufficient and credible measurement of security effectiveness supports informed decision-making in engineering and management practices throughout the system development life cycle. Although detail-level security metrics can be developed for special purposes, their meaningfulness suffers if their relationship to the overall security effectiveness objectives cannot be traced. This paper analyzes the factors contributing to security effectiveness of software-intensive systems