Current trends and advances in IT service infrastructures security assurance evaluation

The term security assurance has been used in the computer science literature to express the
confidence that one has in the strength of the security measures. The need for a methodology to
measure current security assurance levels of a system has been reported in the literature as vital in
order to maintain and improve the overall security. However, a scrutiny of the literature reveals that in
the area of IT security assurance, a large number of research questions still remain without an answer.
Although a number of works have been presented in recent years, especially with respect to assurance
metrics development, little effort has been made in developing a robust operational methodology for
the evaluation of IT service infrastructures security assurance. This paper captures the current status
of research efforts made in the field of security assurance evaluation. It collects previous and current
academic, normalization and commercial work on security assurance, and establishes a
comprehensive state of the art in the domain. In addition, the paper outlines the general features of an
ongoing work aiming at the development of a security assurance evaluation framework that takes into
account the evolving and ubiquitous IT infrastructures. The novelty of this ongoing work lies not only
on the adaptability of the security assurance evaluation system to the evolving infrastructure model
but also on the use of a “bottomup”
approach in evaluating the security assurance level of a service
using aggregation techniques. The methodology is intended to assist network managers in addressing
more promptly security failures within the infrastructure as well as to increase the trust of end users in
using IT systems.

Citation:
Ouedraogo, M. et al. (2009) ‘Current trends and advances in IT service infrastructures security assurance evaluation’ Proceedings of Advances in Computing and Technology, (AC&T) The School of Computing and Technology 4th Annual Conference, University of East London, pp.132-141.