## 7 Discussion  
### Validation of the Derived SPD Values  
Apart from the functional and operational aspects of the proposed framework, it is important to examine wherever the deduced information regarding the SPD aspects of an evaluated system are meaningful and truly reflect the actual protection level. Therefore, we also compare the results of the SPD assessment procedure with similar standardized or widely-used methodologies proposed by the National Institute of Standards and Technology (NIST) [81]. As we presented in the Section 3.1, our method starts with the analysis of the individual components and the estimation of their SPD status. For the evaluation of distinct system modules, software, hardware, or other assets, NIST has established a methodology called Common Vulnerability  
Figure 8: Performance assessment–Response time. Scoring System (CVSS) [82]. The method takes into account known vulnerabilities for the examined component as well as the existence of mitigation mechanisms and tries to figure out their severity and likelihood to be exploited. The result is a score from 0 (low risk) to 10 (high attackability). NIST performs CVSS analyses for known vulnerabilities (e.g., in MySQL, Internet Explorer, Chrome, etc.) and maintains the results in a repository, which is publicly available [82]. Our SPD multi-metric follows a similar approach by assessing the attacker's effort and preference to exploit an existing vulnerability as well as its impact. We also take into account the potential attack vectors (called Threat Flows (TFs) in our methodology) and assess a list of known vulnerabilities (defined as limitations) that the deployed defense mechanisms (controls) may fail to mitigate. Moreover, the SPD levels are meant to be calculated in advance, as the CVSS scores, and be processed by CompoSecReasoner during the system's composition and operation. We utilize CVSS v3.1 Calculator [83] to assess the security for the secure storage service at the device-end with the ULCL component of the smart home example. The derived CVSS base score is 2.7, reflecting low attackability and high security. This is in accordance with the SPD multi-metric assessment and the SPD level of \(\langle 80,50,30\rangle\), where the security (\(S=80\)) also reflects high protection and low exploitation possibility. Similar results were derived for the other individual evaluated components that are referred in the Section 6.5. This fact designates that our proposal successfully discloses the main security notion as it is acceptable by the cyber-security community. Moreover, we have extended the analysis to also cover privacy and dependability in a similar fashion. Furthermore, the proposed methodology goes one step further from the distinct analysis of assets and estimates the overall protection status of the composed system. NIST and the Health Insurance Portability and Accountability Act (HIPAA) [84] have developed the Security Risk Assessment (SRA) tool [85] to evaluate the overall security posture of healthcare organizations. Except from technical features, the tool takes also into account procedural aspects, threat detection and response operations, as well as the human factor. We utilize this tool to evaluate the demonstrated smart home composition and correlate the results with the outcomes of our methodology. We consider the same setting that is described in the Section 6.4, with the same devices and protected assets (e.g., PEP, PDP, etc. ), the contingency and response functionality of the SPD agents, and a home owner with low to moderate security knowledge as the main actuator. Figure 9 depicts the fulfillment of the risk assessment questionnaires as well as the final report of the SRA tool for the smart home setting. The analysis reveals that there is high risk in three of the 25 main security categories that are investigated. The technical safeguards and contingency policies are in place and the reported problems that exhibit high exploitation risk are related with the lack of security knowledge by the user (homeowner).