A Concept for Developing Security Metrics for Application Software in Critical Information Infrastructure Facilities
DOI: 10.21293/1818-0442-2026-29-2-160-176
Abstract: Relevance. The increasing regulatory and legal requirements for information protection in critical information infrastructure (CII) facilities necessitate the development of a system of quantitative measures for assessing the security of application software being developed and used. Purpose of the study. Development of an advanced method for quantitative security assessment of application software based on the methodology of the international standards for software quality. Methods. The study comprehensively employs methods of system analysis, formalization, synthesis, comparative analysis, computational experiment, and regulatory alignment. Scientific novelty. A concept has been developed for introducing a system of quantitative security assessments of application software and a new software security sub-characteristic, "software security levels", as a quality indicator for software under development. A three-level framework for establishing software security levels is proposed, based on a two-contour aggregation model in which blocking and gradable metrics play mathematically distinct functional roles. Results. The applicability of the proposed concept is demonstrated through a case study of calculating security metrics. Practical significance. The proposed system of quantitative assessments for refined security metrics can be applied in projects involving the development and modernization of application software for critical information infrastructure facilities.
Keywords: software security, critical information infrastructure, SQuaRE, security metrics, harmonic mean, blocking metrics, threat model, software security levels
For citation:
Bochkov A. V., Sabanov A. G., Shelupanov A. A. A Concept for Developing Security Metrics for Application Software in Critical Information Infrastructure Facilities. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki, 2026, vol. 29, no. 2, pp. 160–176. DOI: 10.21293/1818-0442-2026-29-2-160-176
Authors and copyright holders:
- Bochkov A. V. , Joint-Stock Company "Research and Design Institute for Informatization, Automation and Communication in Railway Transport" (JSC "NIIAS")
- Sabanov A. G. , Joint-Stock Company "Research and Design Institute for Informatization, Automation and Communication in Railway Transport" (JSC "NIIAS")
- Shelupanov A. A. , Tomsk State University of Control Systems and Radioelectronics
- 1. GOST R 56939–2024. Zashchita informatsii. Razrabotka bezopasnogo programmnogo obespecheniya. Obshchie trebovaniya [Information protection. Development of secure software. General requirements]. Moscow, Standartinform, 2024 (in Russ.).
- 2. GOST R 12207–2010. Informatsionnaya tekhnologiya. Sistemnaya i programmnaya inzheneriya. Protsessy zhiznennogo tsikla programmnykh sredstv [Information technology. System and software engineering. Software life cycle processes]. Moscow, Standartinform, 2010 (in Russ.).
- 3. Ob utverzhdenii Trebovanii po obespecheniyu bezopasnosti znachimykh ob’ektov KII Rossiiskoi Federatsii [On the approval of Requirements for ensuring the security of significant objects of critical information infrastructure of the Russian Federation]. Order No. 239 of the FSTEC of Russia dated December 25, 2017 (in Russ.). Available at: URL: https://fstec.ru/dokumenty/vse-dokumenty/prikazy/prikaz-fstek-rossii-ot-25-dekabrya-2017-g-n-239 (accessed: 09 October 2026).
- 4. Metodicheskii dokument FSTEK Rossii. Sostav i soderzhanie meropriyatii i mer po zashite informacii, soderzhashikhsya v informatsionnykh sistemah [Methodological document of the FSTEC of Russia. Composition and content of measures and activities to protect information contained in information systems]. Approved April 12, 2026 (in Russ.). Available at: https://fstec.ru/dokumenty/vse-dokumenty/spetsialnye-normativnye-dokumenty/metodicheskij-dokument-ot-12-aprelya-2026-g (accessed: 09 October 2026).
- 5. Order of the FSTEC of Russia No. 117 dated 11.04.2025 "On Approval of the Requirements for the Protection of Information Contained in State Information Systems and Other Information Systems of State Bodies, State Unitary Enterprises, and State Institutions" (Registered with the Ministry of Justice of Russia on 16.06.2025 No. 82619) // Official Internet Portal of Legal Information. URL: http://publication.pravo.gov.ru/document/0001202506170011 (accessed: 09.10.2026).
- 6. GOST R ISO/IEC 9126–93. Informatsionnaya tekhnologiya. Otsenka programmnoi produktsii. Kharakteristika kachestva i rukovodstva po ikh primeneniyu [Information technology. Evaluation of software products. Quality characteristics and guidelines for their use]. Introduced 1993-12-28. Moscow, «Izdatel'stvo standartov» Publ. house, 2003 (in Russ.).
- 7. GOST R ISO/IEC TO 12182–2002. Informatsionnaya tekhnologiya. Klassifikatsiya programmnykh sredstv [Information technology. Classification of software]. Introduced 2002-06-11. Moscow, «Izdatel'stvo standartov» Publ. house, 2002 (in Russ.).
- 8. GOST R ISO/IEC 25000–2021. Sistemnaya i programmnaya inzheneriya. Trebovaniya i otsenka kachestva sistem i programmnykh sredstv (SQuaRE). Rukovodstvo [System and software engineering. Systems and software quality requirements and evaluation (SQuaRE). Guide]. Introduced 2021-10-25. Moscow, Russian Institute of Standardization, 2021 (in Russ.).
- 9. GOST R ISO/IEC 25010-2015. Sistemnaya i programmnaya inzheneriya. Trebovaniya i otsenka kachestva sistem i programmnogo obespecheniya (SQuaRE). Modeli kachestva sistem i programmnykh produktov [System and software engineering. Systems and software quality requirements and evaluation (SQuaRE). System and software product quality models]. Introduced 2015-05-29. Moscow, Standartinform, 2015 (in Russ.).
- 10. GOST R ISO/IEC 25022-2021. Sistemnaya i programmnaya inzheneriya. Trebovaniya i otsenka kachestva sistem i programmnogo obespecheniya (SQuaRE). Izmerenie kachestva pri ispol'zovanii [System and software engineering. Systems and software quality requirements and evaluation (SQuaRE). Measurement of quality in use]. Introduced 2021-10-25. Moscow, Russian Institute of Standardization, 2021 (in Russ.).
- 11. GOST R ISO/IEC 25023–2021. Sistemnaya i programmnaya inzheneriya. Trebovaniya i otsenka kachestva sistem i programmnoi produktsii (SQuaRE). Izmereniya kachestva sistemy i programmnoi produktsii [System and software engineering. Systems and software quality requirements and evaluation (SQuaRE). Measurement of system and software product quality]. Introduced 2021-11-19. Moscow, Russian Institute of Standardization, 2021 (in Russ.).
- 12. GOST R 70921–2023. Sistemnaya i programmnaya inzheneriya. Trebovaniya i otsenka kachestva sistem i programmnoi produktsii (SQuaRE). Kontseptsiya trebovanii k kachestvu [System and software engineering. Systems and software quality requirements and evaluation (SQuaRE). Concept of quality requirements]. Introduced 2023-09-14. Moscow, Russian Institute of Standardization, 2023 (in Russ.).
- 13. GOST R 70262.1-2022. Zashchita informatsii. Identifikatsiya i autentifikatsiya. Urovni doveriya k identifykatsii [Information protection. Identification and authentication. Levels of trust in identification] Moscow, Russian Institute of Standardization, 2022 (in Russ.).
- 14. GOST R 70262.2-2025. Zashchita informatsii. Identifikatsiya i autentifikatsiya. Urovni doveriya k autentifikatsii [Information protection. Identification and authentication. Levels of trust in authentication] Moscow, Russian Institute of Standardization, 2025 (in Russ.).
- 15. Shubinskii, I.B. Funktsional'naya nadezhnost' informatsionnykh sistem. Metody analiza [Functional reliability of information systems. Methods of analysis]. Ulyanovsk, Regional Printing House «Pechatnyi dvor», 2012. 295 p. (in Russ.).
- 16. Shubinskii I.B. Nadezhnye otkazoustoichivye informatsionnye sistemy. Metody sinteza [Reliable fault-tolerant information systems. Methods of synthesis]. Ulyanovsk, Regional Printing House «Pechatnyi dvor», 2016, 544 p. (in Russ.).
- 17. Shubinskii I.B., Rozenberg E.N. Funktsional'naya bezopasnost' sistem upravleniya na zheleznodorozhnom transporte [Functional safety of control systems in railway transport]. Moscow, Vologda, Infra-Inzheneriya, 2023, 360 р. (in Russ.).
- 18. Markov A.S. Modeli otsenki i planirovaniya ispytanii programmnykh sredstv po trebovaniyam bezopasnosti informatsii [Models for evaluation and planning of software testing for information security requirements]. Herald of the Bauman Moscow State Technical University. Series Instrument Engineering, 2011, Special issue, pp. 90–103 (in Russ.).
- 19. Markov A.S., Fadin, A.A. Sistematika uyazvimostei i defektov bezopasnosti programmnykh resursov [Taxonomy of vulnerabilities and security defects of software resources]. Zaŝita informacii. Inside, 2013, No. 3, pp. 56–61 (in Russ.).
- 20. Markov A.S., Matveev V.A., Fadin, A.A., Tsirlov, V.L. [Heuristic analysis of source code security]. Herald of the Bauman Moscow State Technical University. Series Instrument Engineering, 2016, no. 1 (106), pp. 98–111. DOI: 10.18698/0236-3933-2016-1-98-111 (in Russ.).
- 21. Merzlyakova E.Yu., Yanchenko E.V. [Review of Software Quality Verification and Evaluation Methods]. Vestnik SibGUTI, vol. 17, 2023, no. 1, pp. 92–106. DOI: 10.55648/1998-6920-2023-17-1-92-106 (in Russ.).
- 22. Kulyamin V.V. Tekhnologii programmirovaniya. Komponentnyy podkhod. Lektsiya 5. Kachestvo programmnogo obespecheniya i metody ego kontrolya [Programming Technologies. Component-Based Approach. Lecture 5. Software quality and methods of its control] (in Russ.). Available: https://studfile.net/preview/993777/page:14/ (accessed: 22 July 2026).
- 23. Goertzel K.M., Winograd Th., McKinley H.L. et al. Software Security Assurance: A State-of-Art Report (SAR). Fort Belvoir, VA: Information Assurance Technology Analysis Center, Data and Analysis Center for Software, 2007.
- 24. Woody C., Ellison R.J., Ryan Ch. Exploring the Use of Metrics for Software Assurance (SEI Report CMU/SEI-2018-TN-004). Carnegie Mellon University, USA, Software Engineering Institute, 2020. https://doi.org/10.1184/R1/12366842.v1.
- 25. Platforma Reflektiz [Reflectiz Platform] (in Russ.). Available at: https://www.reflectiz.com/product/platform-over-view, free (accessed: 21 July 2026).
- 26. State of Web Exposure 2026. URL: https://www.reflectiz.com/learning-hub/web-exposure-2026-research (accessed: 22 July 2026).
- 27. Wen S., Li Z., Lin Y., Hu C., Huang C. Systematic literature review of machine learning based software development effort estimation models. Information and Software Technology, 2012, 54, no. 1, pp. 41–59. DOI: 10.1016/j.infsof.2011.09.002.
- 28. Naeem S., Khoshgoftaar J., Van Hulse J. Predicting Faults in High Assurance Software. Proceedings of the 12th IEEE International Symposium on High Assurance Systems Engineering, November 3-4, 2010, San Jose, CA, USA, IEEE, pp. 26–34. DOI: 10.1109/HASE.2010.29.
- 29. Hassan A.E., Holt R.C. The top ten List: Dynamic Fault Prediction. Proceedings of the 21st IEEE International Conference on Software Maintenance, 26-29 September 2005, Budapest, Hungary, IEEE, 2005, pp. 263–272. DOI: 10.1109/ICSM.2005.91.
- 30. Kindervag J. (2010-11-05). Build Security Into Your Network's DNA: The Zero Trust Network Architecture. Forrester Research. Available at: https://www.virtualstarmedia.com/downloads/Forrester_zero_trust_DNA.pdf (accessed: 22 July 2026).
- 31. Témolé F., Atanasova D. An Integrated Approach to Managing Software Quality in Complex Systems. American Journal of Software Engineering and Applications, 2025, vol. 13, no. 1, pp. 1–17. DOI: 10.11648/j.ajsea.20251301.11.
- 32. Champion K., Khatri S., Hill B.M. Qualities of Quality: A Tertiary Review of Software Quality Measurement Research. arXiv preprint, 2021, arXiv: 2107.13687. DOI: 10.48550/arXiv.2107.13687.
- 33. Derkach E.A., Shelupanov A.A., Novikov S.N., Bragin D.S. [Zero Trust assessment across the software product development lifecycle]. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki, 2025, vol. 28, no. 4, pp. 144–151. DOI: 10.21293/1818-0442-2025-28-4-144-151 (in Russ.).
- 34. Baranov V.V., Shelupanov A.A. [Cognitive model for assessing the security of information systems for various purposes]. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki, 2022, vol. 25, no. 4, pp. 88–100. DOI: 10.21293/1818-0442-2022-25-4-88-100 (in Russ.).
- 35. Derkach E.A., Shelupanov A.A. [Domestic and foreign experience in security testing]. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki, 2024, vol. 27, no. 1, pp. 37–43. DOI: 10.21293/1818-0442-2024-27-1-37-43 (in Russ.).
Last issue
Editorial office address
Executive Secretary of the Editor’s Office
Editor’s Office: 40 Lenina Prospect, Tomsk, 634050, Russia
Phone / Fax: + 7 (3822) 701-582
Executive Secretary of the Editor’s Office
Editor’s Office: 40 Lenina Prospect, Tomsk, 634050, Russia
Phone / Fax: + 7 (3822) 51-21-21 / 51-43-02
Subscription for updates
