Study on Model-based Security Assessment of Information Systems

Security problems of an information system are mainly due to its internal vulnerabilities, by exploiting which external threats do harm to the system. Security Assessment of Vulnerabilities (SAV) is, with appropriate methods, to assess an information system by investigating vulnerabilities in its architecture, hardware, software, networks, and protocols. These methods can be divided into two categories: rule-based and model-based, and the later draws more research focuses at present. In this paper we make an extensive survey on existing model-based approaches to security assessment of vulnerabilities in information systems, analysing their working mechanics, advantages and disadvantages. Finally, conclusions are made on open problems in model-based security assessment, and on the possible future directions of the research.