Methodology for service-oriented management of security assurance in communication infrastructures

We describe in this paper a six step methodology can help to gain security assurance of communication services in a continuous way. The preparatory steps model the service and select relevant metrics to measure the basic assurance on infrastructure objects. During the operational steps, measures are gathered, aggregated along the model, evaluated and displayed in real-time. A five-level assurance taxonomy is proposed, providing evaluation criteria facilitating the metric design and the interpretation of the aggregated assurance.