A Tool for Security Measuring and Probe Management

Designing and maintaining correct security countermeasures to support trustworthiness require comprehensive understanding of current security posture, i.e., Situational Awareness (SA). Security SA means that a decision maker is aware of protected assets, existing vulnerabilities, and risk mitigation techniques. Applying security metrics offers a holistic way to gain Situational Awareness. However, it is a challenge to get input data for security measuring. Currently, systems produce the huge amount of security monitoring data, but this raw data is not in a uniform format or easily available for the measuring purposes. In this paper, we propose a Host-based Security Instrumentation System (HSIS) to facilitate the development of security measuring probes for uniform data collection. The proposed solution supports reusability of measuring probes and makes it possible to manage and adapt probes at operation time. Security administrators and auditors can support trustworthiness with the solution by evaluating systems' security state.