Please guide me to answer the above question. I need to know how can we measure security level???? How can I say this application or system or network is secure or under threat or targeted???
What parameters will be focused during analysis???
Thanks
Keywords: Information security, Network Security, IoT Security, Cyber Security
You can use:
1. Compliance. In general, compliance means conforming to a rule, such as a specification, policy, standard or law (from wiki). For compliance in security we can use ISO 27001, GDPR, ISO 15408 or other standards.
2. Risk. You can apply risk metrics (measures) to the project. They show how the threats are blocked and which damage is probable.
3. Vulnerabilities. CVE/CVSS or other vulnerability measures show quantity metrics for useless or damage for vulnerabilities and their enviroment.
4. Specific measures like data transfer rate (for backup), bandwidth etc.
You can use:
1. Compliance. In general, compliance means conforming to a rule, such as a specification, policy, standard or law (from wiki). For compliance in security we can use ISO 27001, GDPR, ISO 15408 or other standards.
2. Risk. You can apply risk metrics (measures) to the project. They show how the threats are blocked and which damage is probable.
3. Vulnerabilities. CVE/CVSS or other vulnerability measures show quantity metrics for useless or damage for vulnerabilities and their enviroment.
4. Specific measures like data transfer rate (for backup), bandwidth etc.
This is a practise in general. Every information element, system, network resource has to be classified as an asset with key tags like classification (confidential, proprietary etc), value (cost to setup, cost of rebuild if compromised etc) etc. Find the vulnerabilities, identify the threats of exploiting these vulnerabilities, for every possible threat perform a risk analysis. This gives a level of security. Based on how the risks are handled (accept, mitigate, transfer), security posture of it can be evaluated. Again as pointed by Vyacheslav, security level is always relative and your starting point could be any compliance standards as baseline.
- Badges
- Science topic