Security Metrics
Virgilio Viegas, Oben Kuyucu · Apress eBooks · 2022
It has always been a struggle for information security professionals to measure “the effectiveness” of IT security controls. In the 1980s, “orange books” were released for security professionals as a standard to set basic requirements for assessing the effectiveness of security controls built into a computer system (Figure 7-1), which was a part of the Rainbow Series published by the US National Computer Security Center. The most well-known orange book is the Trusted Computer System Evaluation Criteria (TCSEC) and its European counterpart, Information Technology Security Evaluation Criteria (ITSEC) . The Common Criteria for Information Technology Security Evaluation (in short, ISO/IEC 15408) replaced those books. It created a framework for defining security levels for systems (hardware, software, or firmware) and determining acceptable testing methods and certifying system compliance to defined assurance levels.