# Developing Security Assurance Metrics to Support Quantitative Security Assurance Evaluation
## 3 Our Methodological Approach
### More Metrics
#### 3.3.2 Vulnerability Metrics  
Following the same concept practices in the development of security requirement metrics, we define a set of vulnerability metrics to evaluate the weakness of the assurance target, listed in Table 7. In contrast to the positive contribution of security requirement scores on the overall assurance score, in the perspective of vulnerabilities, the higher the actual score, the more severe an assurance component is. That means the scores of all vulnerability components always result in a negative effect on the result. In this regard, there are slight differences in formula definitions in terms of the performance, the actual impact, and the priority score of vulnerabilities.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline \multicolumn{2}{c}{**Maximum Possible Impact of SRP**} & \multicolumn{2}{c}{**Actual Impact of SRP**} \\ \hline
**Impact to SAS** & \(\textit{MpiSasSRP}=\sum\limits_{i=1}^{n}\textit{MpiSasSRC}_{i}\) & (16) & \(\textit{AiSasSRP}=\sum\limits_{i=1}^{n}\textit{AciSasSRC}_{i}\) \\ \hline \hline \end{tabular}
\end{table}
Table 6: Security requirement impact metrics (for SRP).  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Metrics** & **Description** & **Formula** \\ \hline
**Vulnerability Performance** & & \\ _PerVUC_ & Performance of VUC & \(\frac{MaxVUC-ActVUC}{MaxVUC}\times 100\%\) & (19) \\ _PerVUP_ & Performance of VUP & \(\frac{\sum_{i}MaxVUC-\sum_{i}ActVUC}{\sum_{i=1}MaxVUC_{i}}\times 100\%\) & (20) \\ _Vulnerability Impact_ & & \\ _MpiVupVUC_ & Maximum possible impact of VUC on VUP & \(\frac{MaxVUC_{i}}{MaxVUC_{i}}\times 100\%\) & (21) \\ _AciVupVUC_ & Actual impact of VUC on VUP & \(\frac{MaxVUC_{i}}{MaxVUC_{i}}\times 100\%\) & (22) \\ _MpiSasVUC_ & Maximum possible impact of VUC on SAS & \(\frac{MaxVUC_{i}}{MaxVUC_{i}}\times 100\%\) & (23) \\ _AciSasVUC_ & Actual impact of VUC on SAS & \(\frac{MaxVUC_{i}}{MaxVUC_{i}}\times 100\%\) & (24) \\ _MpiSasVUP_ & Maximum possible impact of VUP on SAS & \(\sum\limits_{i=1}^{n}\textit{MpiSasVUC}_{i}\) & (25) \\ _AciSasVUP_ & Actual impact of VUP on SAS & \(\sum\limits_{i=1}^{n}\textit{AciSasVUC}_{i}\) & (26) \\ \multicolumn{2}{p{113.8 pt}}{**Vulnerability Priority**} & & \\ _PrsVUC_ & Priority score of VUC & \(\frac{ActVUC}{MaxVUC_{i}}\) & (27) \\ \hline \hline \end{tabular}
\end{table}
Table 7: Summary of vulnerability metrics.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline \multicolumn{2}{c}{**Maximum Possible Impact of SRC**} & \multicolumn{2}{c}{**Actual Impact of SRC**} \\ \hline
**Impact to SRP** & \(\textit{MpiSrpSRC}=\frac{MaxSRC}{\sum_{i=1}^{n}\textit{MpiSasSRC}_{i}}\times 100\%\) & (12) & \(\textit{AciSrpSRC}=\frac{ActSRC}{\sum_{i=1}^{n}\textit{MpiSSRC}_{i}}\times 100\%\) & (13) \\
**Impact to SAS** & \(\textit{MpiSasSRC}=\frac{MaxSRC}{\textit{MpiSAS}-\textit{MpiSAS}}\times 100\%\) & (14) & \(\textit{AciSasSRC}=\frac{MaxSRC}{\textit{MpiSAS}-\textit{MpiSAS}}\times 100\%\) & (15) \\ \hline \hline \end{tabular}
\end{table}
Table 5: Security requirement impact metrics (for SRC).