Measures and metrics for the enforcement of critical security controls: A case study of boundary defense

Mohiuddin Ahmed; Ehab Al-Shaer

doi:10.1145/3314058.3317730

Measures and metrics for the enforcement of critical security controls: A case study of boundary defense

Mohiuddin Ahmed, Ehab Al-Shaer

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

1 Scopus citations

Abstract

The center for internet security (CIS) publishes a set of defense actions which forms a set of defense in depth best practices known as critical security control (CSC) to detect, prevent, respond, and mitigate the cyber attacks against cyber systems and networks. However, no well defined automated measures and metrics are developed to validate the enforcement of these CSCs. Additionally, it is infeasible to directly analyze the implementation of security products to verify and validate the enforcement of CSCs in those security products. In this poster, we are going to present our preliminary analysis to develop automated measures and metrics for CSC based on threat model each CSC is targeting, measurable features, and cyber artifacts which can be used to create metrics for key enforcement indicators. We also present a case study to develop measures and metrics for a CIS CSC called boundary defense.

Original language	English
Title of host publication	Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019
Publisher	Association for Computing Machinery
ISBN (Electronic)	9781450371476
DOIs	https://doi.org/10.1145/3314058.3317730
State	Published - 1 Apr 2019
Externally published	Yes
Event	6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019 - Nashville, United States Duration: 1 Apr 2019 → 3 Apr 2019

Publication series

Name	ACM International Conference Proceeding Series

Conference

Conference	6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019
Country/Territory	United States
City	Nashville
Period	1/04/19 → 3/04/19

Bibliographical note

Publisher Copyright:
© 2019 Copyright is held by the owner/author(s).

ASJC Scopus subject areas

Software
Human-Computer Interaction
Computer Vision and Pattern Recognition
Computer Networks and Communications

Access to Document

10.1145/3314058.3317730

Cite this

Ahmed, M., & Al-Shaer, E. (2019). Measures and metrics for the enforcement of critical security controls: A case study of boundary defense. In Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019 Article a21 (ACM International Conference Proceeding Series). Association for Computing Machinery. https://doi.org/10.1145/3314058.3317730

@inproceedings{c2c32f92134d4ad99ad2d1bc5f1fba0f,

title = "Measures and metrics for the enforcement of critical security controls: A case study of boundary defense",

abstract = "The center for internet security (CIS) publishes a set of defense actions which forms a set of defense in depth best practices known as critical security control (CSC) to detect, prevent, respond, and mitigate the cyber attacks against cyber systems and networks. However, no well defined automated measures and metrics are developed to validate the enforcement of these CSCs. Additionally, it is infeasible to directly analyze the implementation of security products to verify and validate the enforcement of CSCs in those security products. In this poster, we are going to present our preliminary analysis to develop automated measures and metrics for CSC based on threat model each CSC is targeting, measurable features, and cyber artifacts which can be used to create metrics for key enforcement indicators. We also present a case study to develop measures and metrics for a CIS CSC called boundary defense.",

author = "Mohiuddin Ahmed and Ehab Al-Shaer",

note = "Publisher Copyright: {\textcopyright} 2019 Copyright is held by the owner/author(s).; 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019 ; Conference date: 01-04-2019 Through 03-04-2019",

year = "2019",

month = apr,

day = "1",

doi = "10.1145/3314058.3317730",

language = "English",

series = "ACM International Conference Proceeding Series",

publisher = "Association for Computing Machinery",

booktitle = "Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019",

}

Ahmed, M & Al-Shaer, E 2019, Measures and metrics for the enforcement of critical security controls: A case study of boundary defense. in Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019., a21, ACM International Conference Proceeding Series, Association for Computing Machinery, 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019, Nashville, United States, 1/04/19. https://doi.org/10.1145/3314058.3317730

Measures and metrics for the enforcement of critical security controls: A case study of boundary defense. / Ahmed, Mohiuddin; Al-Shaer, Ehab.
Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019. Association for Computing Machinery, 2019. a21 (ACM International Conference Proceeding Series).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Measures and metrics for the enforcement of critical security controls

T2 - 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019

AU - Ahmed, Mohiuddin

AU - Al-Shaer, Ehab

PY - 2019/4/1

Y1 - 2019/4/1

N2 - The center for internet security (CIS) publishes a set of defense actions which forms a set of defense in depth best practices known as critical security control (CSC) to detect, prevent, respond, and mitigate the cyber attacks against cyber systems and networks. However, no well defined automated measures and metrics are developed to validate the enforcement of these CSCs. Additionally, it is infeasible to directly analyze the implementation of security products to verify and validate the enforcement of CSCs in those security products. In this poster, we are going to present our preliminary analysis to develop automated measures and metrics for CSC based on threat model each CSC is targeting, measurable features, and cyber artifacts which can be used to create metrics for key enforcement indicators. We also present a case study to develop measures and metrics for a CIS CSC called boundary defense.

AB - The center for internet security (CIS) publishes a set of defense actions which forms a set of defense in depth best practices known as critical security control (CSC) to detect, prevent, respond, and mitigate the cyber attacks against cyber systems and networks. However, no well defined automated measures and metrics are developed to validate the enforcement of these CSCs. Additionally, it is infeasible to directly analyze the implementation of security products to verify and validate the enforcement of CSCs in those security products. In this poster, we are going to present our preliminary analysis to develop automated measures and metrics for CSC based on threat model each CSC is targeting, measurable features, and cyber artifacts which can be used to create metrics for key enforcement indicators. We also present a case study to develop measures and metrics for a CIS CSC called boundary defense.

UR - https://www.scopus.com/pages/publications/85068795540

U2 - 10.1145/3314058.3317730

DO - 10.1145/3314058.3317730

M3 - Conference contribution

AN - SCOPUS:85068795540

T3 - ACM International Conference Proceeding Series

BT - Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security, HotSoS 2019

PB - Association for Computing Machinery

Y2 - 1 April 2019 through 3 April 2019

ER -

Measures and metrics for the enforcement of critical security controls: A case study of boundary defense

Abstract

Publication series

Conference

Bibliographical note

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this