# Developing Security Assurance Metrics to Support Quantitative Security Assurance Evaluation
## 4 Security Assurance Analytics
### Security Assurance Analytics Dashboard  
To advance SA analysis, another technique for presenting the assurance metrics is the \"dashboard\". Dashboards are a collection of graphs, charts, gauges, or other visual representations that serve the purpose of viewing multiple datasets at a time [37]. Such visualizations provided by dashboards can lead to the more clear identification of previously unnoticed patterns in data, informing improvement initiatives, and more efficient and effective decision making [38]. Analytics dashboards are typically used to compile large volumes of complex data into measurable key performance indexes (KPIs) that allow businesses to understand and infer meaningful insights. Figure 6 demonstrates an illustrated SA analytics dashboard for the single system analysis, filled with the proposed metrics dataset. This SA analytics dashboard presents a bird's eye view of an assurance target's overall performance, which simplifies the metrics data into more manageable chunks of visual information that allows security stakeholders to easily oversee and explore what they are doing right and what needs to improve. For an effective KPI presentation, the proposed SA dashboard is split into three rows, each containing more reporting panels, starting with a high-level overview and providing easy paths for users to increase the level of granularity. In the first row (Figure 6a), we select and organize the most critical metrics based on what the audience should be notified of at first sight, supporting them by answering the following questions:  
* What is the security assurance level of the assurance target? * What is the overall security performance in the aspects of the security requirement implementation and the vulnerability mitigation? * To what extent are security requirements fulfilled and the number of vulnerabilities found? \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Max** & **Avg** & **Avg** & **Avg** & **Avg** & **Max** & **Avg** & **Total Ocurrences** \\
**Incidence** & **Incidence** & **Weighted** & **Weighted** & **Converage** & **Coverage** & **Coverage** \\
**Rate** & **Rate** & **Exploit** & **Impact** & **Converage** & **Converage** & **Converage** \\ \hline
55.97\% & 3.81\% & 6.92 & 5.93 & 94.55\% & 47.72\% & 318,487 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Data factors of “Broken Access Control” in OWASP Top 10. In the middle row of the dashboard (Figure 6b), the impact of security requirements and vulnerabilities on the security assurance score is presented, distinguished by two reporting panels: the maximin and actual impact. To represent the metrics in a pie chart, we expand the security requirement perspective to the next level (i.e., security requirement criteria), while the vulnerabilities are left as a summary item. This design allows better recognition of the distribution of the impact of security requirements and, at the same time, provides comparative information between the maximum and actual value. In addition, in the actual impact pie chart (the right-side panel), the total occupancy of the non-attainment in security requirements and vulnerabilities is highlighted (i.e., 21.01%). This is the area leading to the credit loss in the security assurance evaluation, which illustrates the weakness portion of the assurance target. The lower row (Figure 6c) is divided into two separated panels. The left panel provides a comparative analysis of security requirement criteria. The use of a radar chart is useful for seeing which criteria are scoring high or low, and the variation between the maximum and actual value. The right-side panels identify the top three critical security requirements and vulnerabilities that the security stakeholders should assign high priorities to improve the security assurance score. Apart from analyzing the metrics for a single system, another aspect to consider in SA analytics is multiple-system comparison.