# Developing Security Assurance Metrics to Support Quantitative Security Assurance Evaluation
## 3 Our Methodological Approach
### Assurance Metrics Calculation: The Core Concept
#### 3.2.3 Assurance Target Evaluation Phase  
The third phase of evaluation is responsible for the calculation of the overall assurance score for the assurance target. This is achieved by aggregating the score of the assurance criteria and perspectives at the following three levels of calculation.  
**Level 1.** The first level is to obtain a summative assurance score for each assurance perspective by accumulating the correspondent assurance criteria. For the assurance perspective SRP, we define a metric _ActSRP_ to present the overall security requirement score of the assurance target. The formula is as follows:  
\[ActSRP=\sum_{i=1}^{n}ActSRC_{i}, \tag{5}\]  
where:  
_ActSRCi_: the actual score of the \(i\)-th SRC;  
_n_: the number of SRCs.  
Correspondingly, the formula used for the calculation of the overall vulnerability score is presented below:  
\[ActVUP=\sum_{i=1}^{n}ActVUC_{i}, \tag{6}\]  
where:  
_ActVICi_: the assurance score of the \(i\)-th vulnerability criterion;  
_n_: the number of VUCs.  
**Level 2.** At the second level, the security assurance score (\(ActSAS\)) of the assurance target is derived by using the difference between the security requirement score (\(ActSRP\)) and vulnerability score (\(ActVUP\)). Thus, the formula is as follows:  
\[ActSAS=ActSRP-ActVUP. \tag{7}\]  
**Level 3.** It can be noticed that the scale of \(ActSAS\) is highly influenced by the number of security requirements as well as vulnerabilities included in the evaluation model (Equations (5) and (6)). This leads to a variable range of assurance scores among different assurance targets and, further, makes it difficult to interpret to make decisions among various systems. In this regard, \(ActSAS\) must be normalized to a common scale for a more comprehensive and understandable value, named the assurance level (\(SAL\)). We adopt the min-max normalization method [32], which preserves the relationships among the original data values. This method will encounter an out-of-bounds error if a future input case for normalization falls outside the first data range for the attribute. The formula of this generic normalization method is presented as follows:  
\[v^{\prime}=\frac{v-min_{A}}{max_{A}-min_{A}}(newmax_{A}-newmin_{A})+newmin_{A}, \tag{8}\]  
where:  
_min\({}_{A}\)_ and \(max_{A}\): the minimum and maximum values of an attribute;  
_newmin\({}_{A}\)_ and _newmax\({}_{A}\)_ and: the new minimum and maximum values after normalization;  
_v_: the old value of an attribute;  
_v_: the new value after normalization.  
The convention we follow for the \(SAL\) is that it lies in the interval between 0 and 10, where 0 corresponds to the worst possible level of security assurance, while 10 to an excellent assurance level. Thus, the formula for the metric \(SAL\) can be simply defined as:  
\[SAL=\frac{ActSAS-MinSAS}{MaxSAS-MinSAS}\times(10-0)+0=\frac{ActSAS-MinSAS}{ MaxSAS-MinSAS}\ \ \times 10. \tag{9}\]  
To derive \(MaxSAS\), we can refer to Equation (7), from which we know that \(SAS\) can be maximum when the following two conditions are met:  
1. all security requirements are fulfilled, which causes the value of \(ActSRP\) to be maximum, and2. all possible vulnerabilities do not exist. This makes _ActVUP_ minimum (zero).  
_SAS_, on the other hand, can become minimum if (i) all protection mechanisms are ineffective to fulfill the defined security requirements (_ActSRP_ is minimum), and (ii) all listed vulnerabilities are found to exist in the assurance target, and all have maximum risk value (_ActVUP_ is maximum).