Security Assurance Aggregation for IT Infrastructures

In the development of more extensive information systems, IT security becomes increasingly important. The need for a tool to measure current security assurance level is therefore vital in order to maintain and improve the overall security of deployed systems. In this paper, we discuss several security assurance aspects and the role of aggregation in this context. Then, we introduce a general method to combine security assurance information into system wide values. This method takes into account the fact that the relations in complex systems are non-linear and also the appearance of emergent properties. Furthermore, using patterns to simplify the process of the system security assurance assessment is presented as an enhancement.