系统安全工程能力成熟模型安全度量研究

为解决在应用系统安全工程能力成熟模型（SSE－CMM）过程中如何度量其应用效果的问题，从两个不同的角度讨论了度量SSE－CMM的应用效果的方法。阐述了“过程度量”和“安全度量”的定义和发展，以及如何对它们进行分组和识别。研究结果表明，安全度量是衡量系统安全状态的运行能力、SSE－CMM过程域实施效果的重要工具。

Security metrics for systems security engineering capability maturity model

A systems security engineering capability maturity model (SSE-CMM) is used to describe the essential characteristics of an organization's security engineering process to ensure good security engineering. A common question posed in using the SSE-CMM is, how to know if these processes will result in a more secure system or operational capability. To answer this question, this paper approaches the question from two different perspectives using metrics as a basis for the answer. The metrics are divided into two kinds: process metrics and security metrics. Then the paper gives the definition and development of metrics and discusses how to group and identify them. Then one conclusion can be drawn: a security metri is an important tool to measure the security status, operational capability of a system and the effects of SSE-CMM process areas.