## 3 Enhanced Clements-Hoffman Model for Databases
For example, passwords have a finite length; ciphers have different cryptographic strengths; different frequency of synchronization points between the database and the transaction log leads to all kinds of, sometimes unacceptable, recovery times in case of failures; dependence of security on the relevance and timeliness of installed updates, configuration parameters, etc. The authors of the model [34,35] believe that for some quantitative evaluation of the security level of objects, it is necessary and possible to measure the degree of system security. As an appropriate structure for expressing such measures, they propose a linguistic variable that assumes values, which are words rather than numbers. To do this, they redefine security barriers \(B\), each of which (\(b_{l}\in B\)) is represented as a composite linguistic variable, the components of which are linguistic variables: \(P_{l}\) is the probability of threat occurrence; \(L_{l}\) is the amount of damage (loss) in case of successful implementation of the threat in relation to the protected object; \(R_{l}\) is security measure resistance (the degree of security measure resistance \(w_{k}\), characterized by the probability of overcoming it). At that, it is noted that these components are evaluated in the context of the specific barrier (\(b_{l}=(t_{i},o_{j},w_{k})\)) that they form. The indices of the \(P_{l}\), \(L_{l}\), \(R_{l}\) linguistic variables are the same as the barrier index, and not the same as those of the \(b_{l}=(t_{i},o_{j},w_{k})\) barrier components in the basic security system--threats, objects, and security measures (controls). [PERSON] and [PERSON] [34,35] state that the resistance value determines the degree of increase or decrease in the overall system security, and an informal combination of the probability and the loss value gives the importance (weight) of the barrier in the overall rating (evaluation). In general, these values determine the contribution of the barrier to the overall system security. However, they do not say anything about specific methods of obtaining (evaluating) them. Therefore, after analyzing the various approaches set out in relevant sources [60, 61, 62] the residual risk \(Rr\) has been selected as such an indicator (metric). The risk remaining after risk treatment (residual risk [57]) is associated with the possibility of implementing threat \(t_{i}\in T\) in relation to the DB object \(o_{j}\in O\) when using security measures (controls) \(w_{k}\in W\). Naturally, that a quantitative approach to risk evaluation is preferable to a qualitative one, since it offers a more tangible value of the situation [63]. The residual risk value characterizing the strength of the barrier \(b_{l}\in B\) can be determined as follows [60,61]:  
\[Rr_{l}=P_{l}L_{l}(1-R_{l}) \tag{3}\]  
Figure 1: Security concepts and their relationship. At the same time, let us clarify that the probability \(P_{l}\) is understood as the probability of an undesirable incident (threat realization), as the product of the probability of the threat occurrence \(P_{l_{i}}\) (the so-called motivational component of the threat realization probability [64]) and the probability of successful exploitation of the vulnerability \(P_{\gamma_{\psi}}\): \(P_{l}=P_{l_{i}}.P_{\gamma_{\psi}}\)[62]. Furthermore, the amount of damage (loss) \(L_{l}\) in relation to the protected object should be considered from the standpoint of the successful implementation of the threat \(t_{i}\) exploiting the vulnerability \(\gamma_{\psi}\). Residual risk is essentially a measure of insecurity asset. Then, the value of the database security can be determined by calculating the reciprocal of the total residual risk [60,61]:  
\[S=\sum_{\forall b_{l}\in B}\frac{1}{P_{l}L_{l}(1-R_{l})} \tag{4}\]  
where \(P_{l},L_{l}\in(0,1)\), \(R_{l}\in[0,1)\). If there are no barriers \(b_{l}\) in the system that block certain paths of implementing threats in relation to the objects, the degree of security measure resistance \(R_{l}\) is taken to be zero.