How to Quantify the Security Level of Embedded Systems? A Taxonomy of Security Metrics

TL;DR

This paper reviews and classifies over 500 security metrics for embedded systems, reducing them to 169 relevant metrics, to establish a foundation for a standardized security evaluation methodology.

Contribution

It introduces a taxonomy for security metrics and provides a comprehensive literature survey, focusing on metrics applicable to embedded system security assessment.

Findings

77.5% of metrics relate to software security

Only 0.6% of metrics address hardware security

169 potential metrics identified for embedded system evaluation

Abstract

Embedded Systems (ES) development has been historically focused on functionality rather than security, and today it still applies in many sectors and applications. However, there is an increasing number of security threats over ES, and a successful attack could have economical, physical or even human consequences, since many of them are used to control critical applications. A standardized and general accepted security testing framework is needed to provide guidance, common reporting forms, and the possibility to compare the results along the time. This can be achieved by introducing security metrics into the evaluation or assessment process. If carefully designed and chosen, metrics could provide a quantitative, repeatable and reproducible value that would reflect the level of security protection of the ES. This paper analyzes the features that a good security metric should exhibit, introduces a taxonomy for classifying them, and finally, it carries out a literature survey on security metrics for the security evaluation of ES. In this review, more than 500 metrics were collected and analyzed. Then, they were reduced to 169 metrics that have the potential to be applied to ES security evaluation. As expected, the 77.5 % of them is related exclusively to software, and only the 0.6 % of them addresses exclusively hardware security. This work aims to lay the foundations for constructing a security evaluation methodology that uses metrics to quantify the security level of an ES.