Software system risk management and assurance

Security, assurance and risk management in software systems are viewed in terms of three historical generations, with significant paradigm shifts occurring in each generation. The software community is currently on the brink of the third generation, and needs advances in modeling, risk theory, tools and assurance methods. The third generation is characterized by a broader, more integrative perspective on risk, and by modeling and measurement. This paper presents a third-generation framework which demonstrates the viability of an integrative and quantitative approach.