Patent ID: 11954208
Assignee: BAE SYSTEMS INFORMATION AND ELECTRONIC SYSTEMS INTEGRATION INC.
Field: IT methods for management (Electrical engineering)
Classification: CPC G | IPC G

Claim 13:
14. A method for a system for security evaluation providing a quantitative methodology for calculating a relative risk of a system security architecture comprising:
a Security Evaluation Framework comprising:
providing a Security Report for said a system architecture;
providing a Vendor Component Errata Report for said system architecture;
providing security Design Guidance and expectations for said system architecture;
providing a Bill of Materials for said system architecture;
inputting said Security Report, said Vendor Component Errata Report, said security Design Guidance and expectations, and said Bill of Materials into a Parametric Data System Security Model;
outputting a System Security View for said system architecture; and
producing a Security Score relative risk report for said security evaluation of said system security architecture whereby said relative risk of said system security architecture is determined,
wherein Data Elements of said Security Evaluation Framework comprise:
Common Elements; and
Security Engineering Specific Elements;
said Common Elements comprising:
Requirements;
fed by Use Cases;
Requirements comprising Sub-System Requirements;
said Requirements providing input to
a System Model, said System Model comprising a Sub-System Model; and
Material Lists;

said Security Engineering Specific Elements comprising:
a Hardware Model;
an Attack Model;
a Countermeasure Model;
a Vulnerability Matrix;
said Hardware Model, said Attack Model, and said Countermeasure Model providing input to said Vulnerability Matrix; and

a Security Score produced from said Vulnerability Matrix;
wherein said Sub-System Model and said Material Lists provide input to said Hardware Model.