Abstract
The most promising approach for developing secure systems is the one which allows software developers to assess and compare the relative security of their programs based on their designs. Thereby, software metrics provide an easy approach for evaluating the security of certain object-oriented designs. They can also measure the impact on security that caused by modifications to existing programs. However, most studies in this area focus on a binary classification of data, either is classified or unclassified. In fact, there are other models with other classifications of data, for instance, the common model used by Defense departments that classifies data into four security levels. However, these various classifications have received little attention in terms of measuring their effect. This paper introduces a model for measuring information flow of security-critical data within a certain object-oriented program with multilevel classification of its security-critical data. It defines a set of object-oriented security metrics which are capable of assessing the security of a given program’s design from the point of view of potential information flow. These metrics can be used to compare the security of programs or assess the effect of program modifications on security. Specifically, this paper proposes a generic model that consists of several security metrics to measure the relative security of object-oriented designs with respect to design quality properties of accessibility, cohesion, coupling, and design size.
Highlights
Security has become one of the most crucial aspects of systems’ development due to the increasing number of risks and breaches which systems are facing
A number of security metrics for object-oriented designs are defined with respect to those quality design properties. These metrics are capable of quantifying the security level of certain programs with regard to the potential flow of security-critical information based on the security design principles of “reducing the size of the attack surface” [9] [10] [11] and “ least privilege” [12] [2]
The model defined in this paper aims to introduce a set of security metrics for programs with multilevel classifications of data secrecy based on their designs
Summary
Security has become one of the most crucial aspects of systems’ development due to the increasing number of risks and breaches which systems are facing. This paper defines a generic model that takes into consideration this aspect It studies the impact on security of four of the most common software design properties, which are used in order to enhance the software quality. A number of security metrics for object-oriented designs are defined with respect to those quality design properties These metrics are capable of quantifying the security level of certain programs with regard to the potential flow of security-critical information based on the security design principles of “reducing the size of the attack surface” [9] [10] [11] and “ least privilege” [12] [2].
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
