Current trends and advances in IT service infrastructures security assurance evaluation

The term security assurance has been used in the computer science literature to express theconfidence that one has in the strength of the security measures. The need for a methodology tomeasure current security assurance levels of a system has been reported in the literature as vital inorder to maintain and improve the overall security. However, a scrutiny of the literature reveals that inthe area of IT security assurance, a large number of research questions still remain without an answer.Although a number of works have been presented in recent years, especially with respect to assurancemetrics development, little effort has been made in developing a robust operational methodology forthe evaluation of IT service infrastructures security assurance. This paper captures the current statusof research efforts made in the field of security assurance evaluation. It collects previous and currentacademic, normalization and commercial work on security assurance, and establishes acomprehensive state of the art in the domain. In addition, the paper outlines the general features of anongoing work aiming at the development of a security assurance evaluation framework that takes intoaccount the evolving and ubiquitous IT infrastructures. The novelty of this ongoing work lies not onlyon the adaptability of the security assurance evaluation system to the evolving infrastructure modelbut also on the use of a “bottomup”approach in evaluating the security assurance level of a serviceusing aggregation techniques. The methodology is intended to assist network managers in addressingmore promptly security failures within the infrastructure as well as to increase the trust of end users inusing IT systems.