## 2 Related Works
In this connection, further research is needed for definition of a rigorous methodology enabling systematic development of security effectiveness metrics. [PERSON] et al. [32] analyze the impact of security policy, deterrence practices and system audit on the information security effectiveness. [PERSON] et al. [33] consider the conceptual framework for security engineering with an emphasis on elicitation and analysis of security requirements. This conceptual framework, as a guide for comparing different methods of developing security requirements, is used by the authors to compare and evaluate current approaches to developing security requirements, such as Common Criteria, Secure Tropos (Tropos is a software development methodology based on the paradigm of agent-oriented software development), Security Requirements Engineering Process (SREP), Multilateral Security Requirements Analysis (MSRA), as well as methods based on Unified Modeling Language (UML) and problem frames. Mapping the terminology of a particular method with a conceptual framework allows to assess the method scope and, therefore, its usefulness for a given purpose. This paper provides an example for comparing methods that can help practitioners and academics to choose the method that best suits their application area. The fundamental monograph [34] and paper [35] discuss the concept of a covered security system, where at least one security measure exists for each identified penetration path. They also describe a formal model (known as the Clements-Hoffman model) that defines the protection domain, the threat domain, security measures and the relationship between them. The model systematizes the resistance, probability, and value measurement process. Resistance is taken to mean the degree to which a security technique succeeds in combating the set of threats against which it has been implemented. The measurement process is based on fuzzy set theory. Various approaches to measuring security, which can be conditionally classified as cost, functional and based on risk analysis, with appropriate methods and metrics for evaluating the asset protection, are described in [36; 37; 38; 39; 40; 41]. The basis for holding any works in the information security area, including the assessment of the protection effectiveness, are International Standards, including ISO/IEC 15408 [42], ISO/IEC 27001 [43], ISO/IEC 27004 [44]. Thus, the International Standard ISO/IEC 15408 defines a common set of requirements for the security functionality of information technology products that can be implemented in the form of hardware, firmware or software, and for the assurance measures applied to these IT products during a security evaluation. It also defines a common approach (model) to assessing security, taking into account threats, vulnerabilities, assets, and risks of harm and the choice of countermeasures. ISO/IEC 15408 is applicable to risks arising from human activities (malicious or otherwise) and to risks arising from non-human activities. It is flexible enough, enabling a range of evaluation methods to be applied to a range of security properties of a range of IT products. Therefore, users of the standard are advised to be careful that this flexibility is not misused. For example, using standards in conjunction with unsuitable evaluation methods, inappropriate security properties, or inappropriate IT products can lead to meaningless evaluation results. The International Standard ISO/IEC 27004 provides guidelines to assist organizations to evaluate the information security (InfoSec) performance and the effectiveness of an information security management system (ISMS) in order to fulfill the requirements set out in ISO/IEC 27001. It establishes monitoring and measurement of information security performance, monitoring and measurement of the ISMS effectiveness, including its processes and controls, analysis and evaluation of monitoring and measurement results.