On System Security Metrics and the Definition Approaches

In this survey paper, we assess existing approaches to security metric definition. We classify proposed definitions and discuss their advantages and problems. We argue that without a more restrictive definition, the apparently common term degenerates to a mere buzzword, which can be dangerous in terms of suggested comparability. We conclude with some guidelines on IS metric definition and sketch an alternative concept for the operational IS security evaluation.