Building Out Your Strategic Security Metric Framework
For years now, security professionals have been in agreement that a security metrics program is an increasingly important tool to manage the security posture in an environment. We like to cite too-true cliches like "you can't manage what you don't measure" and sing "Kumbaya" together about the virtue and benefits of programs. And yet there really aren't many success stories out there.
Thu, May 12, 2011
CSO — For years now, security professionals have been in agreement that a security metrics program is an increasingly important tool to manage the security posture in an environment. We like to cite too-true cliches like "you can't manage what you don't measure" and sing "Kumbaya" together about the virtue and benefits of programs. And yet there really aren't many success stories out there.
Some programs focus heavily on operational metrics. These enterprises are managing their cost centers in traditional business ways -- comparing the "work" output from a security group and comparing it to the "resource" inputs -- usually personnel, time, and costs. So they learn how many security professionals it takes to change a light bulb but not whether it brings any illumination to the program. To be sure, there is value in these metrics the same way there is value in any cost-center management tools. We try to reduce our cost per work-unit efficiency just as a matter of principle.
But these metrics don't help us answer that one, overriding, agonizing, mildly annoying question that we usually get during a chance encounter with a senior executive in the elevator: "So, are we secure?"
Sure, it's not that simple, and that's the point. In order to be invited to discuss strategic matters with senior management, we have to be able to competently answer that question. It's the one question to rule them all, and we know it.
Many security professionals think they are going to answer that question by putting together a metrics program that is a bunch of numbers related to some control framework like COBIT or ISO 27002. At best, the individual metrics are organized alphabetically. At worst, they are recapitulated on a page every month and could be used as a pseudo-random-number generator to seed our encryption algorithms. But these are not the numbers to put in front of senior management.
What the business executive wants to hear is that quick and dirty elevator pitch. What are these numbers and why should I care? So the successful metrician will compile a narrative that describes the numbers:
"Last month, our IT and information assets generated $20 million in revenue in support of 15,000 people using 350 applications. To accomplish this feat, over 32 million connections were attempted across our systems and we applied specific control measures an average of 2.4 times per connection to ensure the completeness and accuracy of our transactions. As a result, over 4 million connections were blocked instantly for not meeting our basic requirements (with 99.75 percent success rate) and we identified 1,700 suspect connections that required further analysis. We ultimately determined that five of those 1,700 were attempted intrusions which we subsequently acted upon according to established procedures. There were no losses associated with the incidents."
