Towards operational measures of computer security: Experimentation and modelling

Abstract

The two experiments described here were intended to investigate the empirical issues that arise from the probabilistic view of security assessment discussed in the previous paper. Specifically, they investigated the problems of measureing effort and reward associated with security attacks and breaches