Development of security metrics for a distributed messaging system

Carefully designed security metrics of practical relevance can be used to provide evidence of the security behavior of the system under development or operation. This study investigates a practical development of security metrics for a distributed messaging system based on threat and vulnerability analysis and security requirements. Our approach is thus requirement-centric. The high-level security requirements are expressed in terms of lower-level measurable components applying a decomposition approach. Both non-attack strategy oriented and attacker behaviour oriented metrics are investigated. The available on-line evidence information of the security performance of the system is integrated with off-line metrics to enable holistic decision-making for security management of the system