## 3 Materials and Methods
### SPD Multi-Metric
#### 3.1.2 Protection Level  
At this point, the surface metrics reveal the attackability of a system, but not the protection level. The SPD multi-metric methodology further extends the system's surface with the _porosity_ feature. The TFs in the surface constitute the system pores where interaction among threats and assets is possible. Every TF is disassembled in security, privacy, and dependability pores, called _Access_, _Trust_, and _Complexity_ pores respectively, representing its effect in the three SPD properties respectively. The system designer places controls (defence mechanisms) to protect the pore from attacks. Limitations form known conditions under which a control does not work properly. If all types of controls are placed for a pore and work correctly, full coverage of the interaction point is achieved. _Controls_ are the means that are applied by the system to restrict a threat's impact and increase the separation with the assets (e.g., protection mechanisms imposing authentication, confidentiality, or integrity). Two control types are described: (i) interactive controls which affect directly the operation when the interaction happens; and process controls which influence indirectly the operation by safeguarding the assets after the interaction's occurrence. Totally, _12 interactive_ and _14 passive controls_ are defined based on the aforementioned relevant security, privacy, and dependability standards. Table 11 in Appendix A summarizes these controls. The applied controls of each pore are identified. At least one instance of each control type must be acquired in order to accomplish the perfect coverage for the pore. All of them contribute equally to a pore's coverage. The porosity value is defined as the TFs' summation, called _PorosityBase_. Perfect coverage for the two control types, defined as _PerfectCoverageInteractive_ and _PerfectCoveragePassive_ respectively, is denoted as:  
\[PerfectCoverageInteractive=PorosityBase\times 12 \tag{3}\]  
\[PerfectCoveragePassive=PorosityBase\times 14 \tag{4}\] \begin{table}
\begin{tabular}{c l l} \hline \hline
**SPD Property** & \multicolumn{1}{c}{**Damage Potential**} & \multicolumn{1}{c}{**Effort**} \\ \hline \multirow{4}{*}{Security} & Privilege [62] & Access rights [62] \\  & -Root: 5 & _-Administrator: 4_ \\  & _-Debugger: 4_ & _-Authenticated user: 3_ \\  & _-Authenticated user: 3_ & _-Anonymous user: 1_ \\  & PII (personal identifiable information) type [64] & PII actuator [64] \\  & _-Sensitive personal data: 5_ & _-PII principal: 4_ \\  & _-Personal data: 4_ & _-Contract_ _PII processor: 3_ \\  & _-Statistical data:1_ & _-Third party: 2_ \\  & Criticality [65] & Dependency level [65] \\  & _-Mission critical: 4_ & _-Coupling: 4_ \\  & _-Business critical: 3_ & _-Outgoing dependency: 3_ \\  & _-Business operational: 2_ & _-Incoming dependency: 2_ \\  & _-Business supporting: 1_ & _-Independent operation: 1_ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _DP-E_ ratios. _Limitations_ represent the inability for the defense mechanisms to work properly. They indicate the SPD state in regards to known restrictions and flaws. Six limitation types are modelled. Vulnerability, disclosure, and exposure limitations harm security, privacy, and dependability pores respectively. Weakness and concern limitations decrease the positive contribution of interactive and passive controls respectively. Anomaly limitations (faulty situation that cannot be controlled) state unidentifiable elements that are nor observed during the normal operation. A proper audit should take into account any anomalies as such situations cannot be controlled. They obstruct all three SPD factors and their effect is aggregated to each factor's evaluation. For each pore, the deployed controls must be denoted. Then, the contribution of the relevant limitations on the deployed controls is measured based on the _attack potential_ risk analysis that is described in CEM [15].