Mathematical Model for Security Effectiveness Figure of Merit and Its Optimization

A new mathematical model for the prediction of the security figure of merit of an assured information system is proposed. The security effectiveness figure of merit is defined as a multi-variate composite function of the strength of security mechanism, usability, performance, and cost. The problem of determining the optimal set of security controls for a given system is then formulated as mathematical optimization problem and the potential methods of approach are addressed. The concept is illustrated with a simple example and the conclusions bring out the benefits of the model.