This project suggests a security evaluation framework for distributed information systems, responsible for generating a system modelling technique and an evaluation method. The framework is flexible and divides the problem space into smaller, more accomplishable subtasks with the means to focus on specific problems, aspects or system scopes.
The information system is modeled by dividing it into increasingly smaller parts, evaluate the separate parts and then build up the system “bottom up” by combining the components. Evaluated components are stored as reusable instances in a component library.The evaluation method is focusing on technological components and is based on the Security Functional Requirements (SFR) of the Common Criteria.
The method consists of the following steps: define several security values with different aspects, to get variable evaluations change and establish the set of SFR to fit the thesis, interpret evaluated security functions, and possibly translate them to CIA or PDR, map characteristics from system components to SFR and combine evaluated components into an evaluated subsystem.
An ontology is used to, in a versatile and dynamic way, structure the taxonomy and relations of the system components, the security functions, the security values and the risk handling. It is also a step towards defining a common terminology for IT security.
Source: Linköping University
Author: Andersson, Richard
>> Design, Modeling and Simulation Projects
>> More B.Com Computer Application Projects