## 2 Related Works  
Information security metrics, as noted in the NIST document [8], are an important factor in making informed decisions on various aspects of security, from the design of architectures and security controls to effectiveness and efficiency security operations. Effectiveness is understood as a property of the assessment object, representing how well it provides security in the context of its actual or proposed operational use [5; 6]. Security effectiveness means the confidence that the security-enforcing mechanisms of the system meet the stated security objectives (that is, they do nothing other than what they should do while satisfying expectations for resiliency) [8; 16; 17]. Security efficiency denotes assurance that adequate security quality has been achieved in the system under study, meeting the resource, time and cost constraints [16; 17]. A systematic survey of system security metrics is given in [18]. To measure security at the system level, the authors propose a structure of security sub-metrics based on vulnerability metrics, defenses metrics, attack metrics, and situation metrics. Each of these sub-metrics has a hierarchical structure. This paper discusses open questions in the research domain of security metrics and proposes key factors for improving security metrics from a system security perspective. Despite the abundance of models and recommendations used for evaluating information security performance, [PERSON] et al. [19], referring also to other authors [20; 21; 22], point to the lack of studies that could comprehensively measure or consider information security through the use of specific positioning indicators. They criticize the existing models for their narrow focus or impossibility to apply in practice. Therefore, they propose their own multilevel model for measuring information security performance, which belongs to the scope of qualitative assessment of organizations' systems. Based on the argumentation theory, [PERSON] et al. [23] derived and showed what requirements should be fulfilled by the security metrics of information technology (IT). [PERSON] et al. [24] proposes a quantification method that aims to evaluate the security assurance of systems by measuring the level of confidence that mechanisms that meet security requirements are present and the vulnerabilities associated with potential security threats are absent. They use this method to evaluate the security level of some REST APIs. [PERSON] [25], noting much work done in the development of methods for quantitative security assessment, speaks of the need for multiple approaches, including formal methods, probabilistic methods, benchmarking and experimentation, classical risk assessment, threat and vulnerability assessment, as well as informal and semi-formal methods. At the same time, for the developed metrics and approaches to be useful, their usability must be thoughtful. Various aspects of database security are discussed in [11; 12; 26; 27; 28; 29; 30; 31]. Obtaining sufficient and credible security evidence of the system under study is one of the main challenges in information security engineering and management is noted in [16]. System developers, project managers, and executive management need information about the security status of technical systems at various stages of the system lifecycle. This study proposes a new Security Metrics Objective Segments (SMOS) model to enable the design of security metrics taxonomies. The model can be integrated with risk-based security metrics development approaches. The studies carried out and described in [17] revealed such factors contributing to a holistic perception of security effectiveness in software systems, as evidence of (a) direct security effectiveness, (b) quality of risk assessment, (c) security correctness and system quality. However, as noted in the paper, their practical application causes certain difficulties. For example, measuring security effectiveness directly is not easy, and in practice, it is only partially possible.