# Developing Security Assurance Metrics to Support Quantitative Security Assurance Evaluation
## 3 Our Methodological Approach
### More Metrics
#### 3.3.1 Security Requirement Metrics  
Security requirement metrics relate to a measurement that evaluates whether security protection mechanisms exist and fulfill defined security requirements. We identified metrics as part of the security requirement metrics category when the metric is primarily a measure of requirements and their specification. We identified three subcategories of security requirement metrics: performance metrics, impact metrics, and prioritization metrics.  
**Security Requirement Performance**. These metrics are used to gauge to what extent security protection mechanisms exist and fulfill defined security requirements. This performance metric is measured mainly at the level of assurance perspectives as well as assurance criteria, derived using the ratio between the actual score and maximum score. Thus, the formula to calculate the performance of the \(i\)-th SRC is:  
\[PerSRC_{i}=\frac{ActSRC_{i}}{MaxSRC_{i}}\times 100\%. \tag{10}\]  
Consequently, the formula to calculate the performance of the SRP is defined as follows.  
\[PerSRP=\frac{\sum_{i=1}^{n}ActSRC_{i}}{\sum_{i=1}^{n}MaxSRC_{i}}\times 100\%, \tag{11}\]  
where:  
\(n\): the number of SRCs.  
**Security Requirement Impact**. These metrics are used to measure and identify the positive effects (or contribution) of security requirement fulfillment on the security assurance score. Knowing the impact will allow stakeholders to figure out ways to maximize the positive in alignment with the security goal. To measure the impact of security requirements, we adopt two categories of metrics: (1) the impact on the overall security requirement (i.e., SRP), and (2) the impact on the security assurance score (i.e., SAS). The former metrics constrain the impact evaluation within the perspective of security requirements only, while the latter expands the scope to the whole assurance score (including the vulnerability perspective). To investigate the range of the security requirement impact, for each category, we calculate its maximum and actual value. As a result, four metrics are defined to evaluate the security requirements impact. Table 5 presents the four metrics for the evaluation of the security requirement impact at the level of SRC and the corresponding formula. We also apply the impact metrics at the level of SRP, but only consider the category of \"Impact to SAS\". Table 6 lists the two metrics for SRP.  
**Security Requirement Prioritization**. After the performance and impact of security requirements are measured through the above metrics, it is necessary for stakeholders taking action to implement corresponding security mechanisms to fulfill the expected requirements. However, with limited resources in organizations, it is difficult for security stakeholders to fulfill these security requirements simultaneously. To help stakeholders determine the order of implementation, we define a metric at the level of SRC, named Priority Score (_PrsSRC_), which is calculated using the formula as follows:  
\[\textit{PrsSRC}_{i}=\frac{MaxSRC_{i}-ActSRC_{i}}{MaxSRC_{i}}. \tag{18}\]