Security metrics for risk assessment of distributed information systems

The paper considers the main issues and recommendations for using the risk assessment techniques based on the analysis of static, dynamic and historical security information. The system of security metrics and techniques for their calculation are suggested. Proposed techniques are based on attack graphs and service dependencies. They allow evaluating security of network topologies, malefactors and attack characteristics, and integral security properties and characteristics calculated on the basis of the cost-benefit and zero-day vulnerability analysis. The approach is intended to be implemented in the framework of the FP7 EU MASSIF project.