"Security Gap" as a metric for enterprise business processes. Issue 6 (18th September 2022)

• Record Type: Journal Article
• Authors: Mukherjee, Preetam; Sengupta, Anirban; Mazumdar, Chandan
• Is Part Of: Security and privacy. Volume 5:Issue 6(2022)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2022-09-18
• Subjects: attack graph -- business process model -- business process security -- CVSS -- security measurement -- security metric -- security requirement; Computer security -- Periodicals; Data protection -- Periodicals; Cyberterrorism -- Periodicals; 005.8
• DOI: 10.1002/spy2.263
• Languages: English
• ISSNs: 2475-6725

Abstract

Abstract: Security is becoming an indispensable factor for the well‐being of an enterprise. Enterprises are making huge investments to fulfill the demand for security. A big challenge faced by an enterprise while securing itself is to find the gap between the demand for security and the actual security status. Finding out a consistent metric for measuring this gap can enable security administrators to utilize the allocated funds more appropriately. Popular control gap analysis methods practiced in enterprises are mostly subjective in nature and results in imprecise measurements. To address this issue, a novel security metric "Security Gap" is introduced in this paper. This metric finds out the business process‐level insecurity from the security requirements and the estimated security. The methodology uses business process modeling, attack graph modeling, and relevant base metrics to compute Security Gap.