Model Based Evaluation of Cybersecurity Implementations

Evaluation of Cybersecurity implementations is an important issue that is increasingly being considered in the agenda of organisations. We present here a model for the evaluation of Cybersecurity requirements. We start by establishing a set of security requirements in the form of a hierarchical structure to obtain a requirement tree, as it is prescribed by the Logic Score of Preference (LSP) evaluation method. Security requirements have been taken from the ISO/IEC 27002 standard. This requirement tree and an aggregation structure, built into a later step, form our Cybersecurity evaluation model, which allows to obtain a numerical final result for each system under evaluation. These final indicators, ranging into the interval 0.. 100, clearly show the degree of compliance of the systems under evaluation with respect to the desired requisites.