信息安全软硬件符合性评估的形式化元数据库

为欧盟《网络弹性法案》准备AI增强型SIEM：从业者案例研究

Preparing an AI-Augmented SIEM for the EU Cyber Resilience Act: A Practitioner Case Study

本研究通过SEUXDR案例，提出六步法将欧盟CRA法规转化为可操作准备，涵盖风险评估、漏洞报告及符合性评估，为中小企业提供可复制的合规路径。

Privacy Assessment of Software Architectures based on Static Taint Analysis

Privacy analysis is critical but also a time-consuming and tedious task. We present a formalization which eases designing and auditing high-level privacy properties of software architectures. It is incorporated into a larger policy analysis and verification framework and enables the assessment of commonly accepted data protection goals of privacy. The formalization is based on static taint analysis and makes flow and processing of privacy-critical data explicit, globally as well as on the level of individual data subjects. Formally, we show equivalence to traditional label-based information fl…

CMMC评估中标准化证据抽样的必要性：基于调查的评估者实践分析

The Need for Standardized Evidence Sampling in CMMC Assessments: A Survey-Based Analysis of Assessor Practices

本研究通过调查CMMC认证评估者的实践，发现证据抽样缺乏标准化，主要依赖评估者判断，导致评估结果不一致，并提出需要风险知情的标准化抽样方法。

CRSTIP - An Assessment Scheme for Security Assessment Processes

Complex networked systems are an integral part of today's support infrastructures. Due to their importance, these systems become more and more the target for cyber-attacks, suffering a notable number of security incidents. Also, they are subject to regulation by national and international legislation. An operator of such an infrastructure or system is responsible for ensuring its security and correct functioning in order to satisfy customers. In addition, the entire process of risk and quality control needs to be efficient and manageable. This short paper introduces the Compliance, Risk Assess…

Identifying Relevant Information Cues for Vulnerability Assessment Using CVSS

The assessment of new vulnerabilities is an activity that accounts for information from several data sources and produces a `severity' score for the vulnerability. The Common Vulnerability Scoring System (\CVSS) is the reference standard for this assessment. Yet, no guidance currently exists on \emph{which information} aids a correct assessment and should therefore be considered. In this paper we address this problem by evaluating which information cues increase (or decrease) assessment accuracy. We devise a block design experiment with 67 software engineering students with varying vulnerabili…

From Closed-world Enforcement to Open-world Assessment of Privacy

In this paper, we develop a user-centric privacy framework for quantitatively assessing the exposure of personal information in open settings. Our formalization addresses key-challenges posed by such open settings, such as the unstructured dissemination of heterogeneous information and the necessity of user- and context-dependent privacy requirements. We propose a new definition of information sensitivity derived from our formalization of privacy requirements, and, as a sanity check, show that hard non-disclosure guarantees are impossible to achieve in open settings. After that, we provide an …