Security Metrics and Security Indicators - specifically for mobile phones, infrastructure, services and applications

The problem with today´s assumingly secure products (and security products for that matter) is that noone knows the actual security, and security assurance, in non-relative terms. Objective figures are needed for this purpose. The thesis work is aimed at solving this dilemma. And give for example a mobile network operator, the chance to answer the question How secure is your product? Security metrics (how to measure security and security assurance) and security indicators (how to present the metrics results to different target groups at different levels in an organization) are to be analyzed. The main target organizations are mobile phone and infrastructure manufacturers, mobile operators and applications providers.

Task 1: Describe state-of-the-art for security metrics and indicators inside/outside the mobile phone world.
Task 2: Describe current use of security metrics and indicators for mobile phones.
Task 3: Suggest a reference model for security metrics and indicators analysis.
Task 4: Define what is needed to provide optimal security metrics and indicators.
Task 5: Define the different components of the reference model to address.
Task 6: Analyze the importance of each component with focus on forensics.
Task 7: Suggest improvements for each component with focus on forensics.
Task 8: Prepare a report with findings.
Task 9: Prepare guidelines for for use in both design and operational phases of a product´s lifecycle.