Measuring Software Security using MACOQR (Misuse and Abuse Case Oriented Quality Requirement) Metrics: Defensive Perspective

The present age, software is exploited and the understanding of increasing extent of risk exposure as a result is rarely developed. Security should be incorporate right from the requirements phase so that the security is inbuilt and properly incorporated into the software in development. To establish the fact that a process is improving or not is a matter that seems impossible without obtaining the measurements. Security requirements can be defined and developed using a no. of techniques like fault tree analysis, failure mode and effect analysis, threat modeling, misuse / abuse cases, attack tree etc. The obtained requirements are qualitative hence they needs to be converted into quantitative measure using some metrics. Security metrics is defined as quantifiable measures which show how much security a product or process simply possess and is normally built from the low level physical measures and at high level they can be considered as quantifiable measurements of some aspect of the system. Certain Object Oriented modeling techniques like Misuse case, Use case Abuse case are very helpful in incorporating security requirements in the early stages of software development phases. ie requirement phase. In this paper, MACOQR metrics from defensive perspective is proposed whose aim is to measure the predicated and observed ratio of flaw and flawlessness