Measuring software security using SAN models

Security is one of the important issues in developing and implementing software systems especially in highly critical applications. Quantification and measurement of security is one of the approaches adopted to achieve the desired degree of security. In this paper, Stochastic Activity Networks (SANs) are used to formally model the attacks on the system under investigation. To this end, the semi-Markov attack model is sketched. Having the semi-Markov model, Probability of Attack Success (PAS), Mean Time to First Breach (MTFB), and System Misuse Proportion (SMP) are measured according to the appropriate transformation of the model to a SAN model. As a case study, we have studied a high-level attack on a password authentication subsystem. The results prove the applicability and suitability of our proposed method in making the compromise between security and other system requirements.