1. Siv Hilde Houmb, SU-group, NTNU
Status PhD work 19. Nov.
Siv Hilde Houmb, SU-group, NTNU

2. General info Name: Siv Hilde Houmb
Supervisors: Professor Tor Stålhane, Professor Maria Letizia Jaccheri, Per R. Hokstad Sintef Teknologiledelse, Sikkerhet og pålitelighet
Year of Ph.D.: Second year
Title of Ph.D.: ‘Quantifying security risks using "all" available data: A risk-based integrated system development and risk management approach’

3. Status More or less finished the credit part of the PhD work
Missing one presentation in IT-emner
Will take a substitution course for one of the courses (stochastic processes and system theory)
Done some work on the background part
Published some papers
Given a tutorial on Critical Systems Development using MBRA and UMLsec: Methods and Tools
Working on two papers
Process
Algorithm

4. Last semester
Guest stay at Sintef Tele and Data in Oslo under the supervision of Dr. Ketil Stølen
Worked on refining and extending the CORAS MBRA methodology for quantification of risks (SOL)
Locked into RA methods from the Safety and Security domain (HazOp, FMEA, FTA, Markov, Monte Carlo Simulation, Attack tree analysis, checklist – will lock into BBN and PN)
Adapted these methods to security assessment
Evaluate and then combining (taking the “best” and most suitable from each method) methods for description models for subjective expert judgment
Working on an extension to UML for security assessment as a platform for communication which is crucial when combining data (same understanding)

5. Next semester
Papers
Integrated system development and risk management process for quantification of risks
How to make use of all available data when quantifying risks
Extension to UML for quantifying risk using subjective expert judgment – Security assessment Object Language (SOL)
Integrated process for secure systems development and how we can use UMLsec to express and test non-functional requirements: co-operation with Jan Jurjens

6. Next semester cont. Results from AIBO-lego-project so fare
FIPA agent security
Result from the Honepot-project: obtaining, analysing and using “objective” data when quantifying risks

7. Next semester: things to do
Refining and extending the process
Work on how to best make use of all available data (objective and subjective)
Objective data
Continue working on establishing a honeynet in corporation with PDS at Økokrim (includes one Honeypot and one IDS at the moment)
Investigate what on how required other objective data/information can be obtain (in corporation with SIS?)

8. Open issues Trials; how, when and how many? The stay abroad
Professor Dr. Eric Sharf, QMUL
Professor Dr. Robert France, Colorado State University
Professor Dr. Davis Basin, ETG