Security Metrics

Security Metrics is the first comprehensive best-practice guide to defining, creating, and utilizing security metrics in the enterprise.

Using sample charts, graphics, case studies, and war stories, Yankee Group Security Expert Andrew Jaquith demonstrates exactly how to establish effective metrics based on your organization's unique requirements. You'll discover how to quantify hard-to-measure security activities, compile and analyze all relevant data, identify strengths and weaknesses, set cost-effective priorities for improvement, and craft compelling messages for senior management.

Security Metrics successfully bridges management's quantitative viewpoint with the nuts-and-bolts approach typically taken by security professionals. It brings together expert solutions drawn from Jaquith's extensive consulting work in the software, aerospace, and financial services industries, including new metrics presented nowhere else. You'll learn hot to:

• Replace nonstop crisis response with a systematic approach to security improvement
• Understand the differences between "good" and "bad" metrics
• Measure coverage and control, vulnerability management, password quality, patch latency, benchmark scoring, and business-adjusted risk
• Quantify the effectiveness of security acquisition, implementation, and other program activities
• Organize, aggregate, and analyze your data to bring out key insights
• Use visualization to understand and communicate security issues more clearly
• Capture valuable data from firewalls and antivirus logs, third-party auditor reports, and other resources
• Implement balanced scorecards that present compact, holistic views of organizational security effectiveness
  

• Chapter 1: Introduction: Escaping the Hamster Wheel of Pain
• Risk Management Is Where the Confusion Is
• Metrics Supplant Risk Management
• Summary
  
• Chapter 2: Defining Security Metrics
• Security Measurement Business Drivers
• Roadblocks to Data Sharing
• Modeling Security Metrics
• Modelers Versus Measures
• Quality Assurance Literature
• Public Health Terminology and Reporting Structure
• Portfolio Management
• Accelerated Failure Testing
• Insurance
• What Makes a Good Metric?
• "Metric" Defined
• Consistently Measured
• Cheap to Gather
• Expressed as a Number or Percentage
• Expressed Using at Least One Unit of Measure
• Contextually Specific
• What Makes a Bad Metric?
• Inconsistently Measured
• Cannot Be Gathered Cheaply
• Does Not Express Results with Cardinal Numbers and Units of Measure
• What Are Not Metrics?
• Misuse of Security Taxonomies
• Annualized Loss Expectancy
• Summary
  
• Chapter 3: Diagnosing Problems and Measuring Technical Security
• Using Metrics to Diagnose Problems: A Case Study
• Defining Diagnostic Metrics
• Perimeter Security and Threats
• E-mail
• Antivirus and Antispam
• Firewall and Network Perimeter
• Attacks
• Coverage and Control
• Antivirus and Antispyware
• Patch Management
• Host Configuration
• Vulnerability Management
• Availability and Reliability
• Uptime
• System Recovery
• Change Control
• Application Security
• Black-Box Defect Metrics
• Qualitative Process Metrics and Indices
• Code Security Metrics
• Summary
  
• Chapter 4: Measuring Program Effectiveness
• Using COBIT, ITIL, and Security Frameworks
• Frameworks
• Not Useful: Asset Valuation
• Planning and Organization
• Assessing Risk
• Human Resources
• Managing Investments
• Acquisition and Implementation
• Identifying Solutions
• Installing and Accrediting Solutions
• Developing and Maintaining Procedures
• Delivery and Support
• Educating and Training Users
• Ensuring System Security
• Identifying and Allocating Costs
• Managing Data
• Managing Third-Party Services
  
• Monitoring
• Monitoring the Process
• Monitoring and Evaluating Internal Controls
• Ensuring Regulatory Compliance
  
• Summary
  
• Chapter 5: Analysis Techniques
• Mean (Average)
• Median
• Standard Deviation
• Grouping and Aggregation
• Records and Attributes
• Grouping
• Aggregation
  
• Time Series Analysis
• Cross-Sectional Analysis
• Quartile Analysis
• Quartile Summary Statistics
• First-Versus-Fourth Analysis
  
• Correlation Matrices
• Summary
  
• Chapter 6: Visualization
• Design Principles
• It Is About the Data, Not the Design
• Just Say No to Three-Dimensional Graphics and Cutesy Chart Junk
• Don't Go off to Meet the Wizard
• Erase, Erase, Erase
• Reconsider Technicolor
• Label Honestly and Without Contortions
• Example
  
• Stacked Bar Charts
• Waterfall Charts
• Time Series Charts
• Basic Time Series Charts
• Indexed Time Series Charts
• Quartile Time Series Charts
  
• Bivariate (X-Y) Charts
• Two-Period Bivariate Charts
  
• Small Multiples
• Quartile-Plot Small Multiples
  
• Two-by-Two Matrices
• Period-Share Chart
• Pareto Charts
• Tables
• Treemaps
• Creating Treemaps
  
• Thinking Like a Cannibal: the Case for Redrawing
• A Patch Job for Ecora
• Reorienting SecurCompass
• Managing Threats to Readability
  
• Summary
  
• Chapter 7: Automating Metrics Calculations
• Automation Benefits
• Accuracy
• Repeatability
• Increased Measurement Frequency
• Reliability
• Transparency
• Auditability
• Can We Use (Insert Your Favorite Tool Here) to Automate Metrics?
• Spreadsheets
• Business Intelligence Tools
• Security Event and Incident Management (SIEM) Products
• Technical Requirements for Automation Software
• Data Model
• Threats
• Exposures
• Countermeasures
• Assets
• Data Sources and Sinks
• Data Sources
• Data Sinks
• Data Interfaces
• Data Source Interfaces
• Data Sink (Presentation) Interfaces
• Metrics Program Management
• Implementing Metrics Automation: a Case Study
  
• Summary
  
• Chapter 8: Designing Security Scorecards
• The Elements of Scorecard Style
• Complete
• Concise
• Clear
• Relevant
• Transparent
• The Balanced Scorecard
• History
• Composition
• Flexibility of the Balanced Scorecard
• Challenges and Benefits of the Balanced Scorecard
• Creating the Balanced Security Scorecard
  
• The Case Against "Security-Centric" Balanced Scorecards
• The Process of Creating the Balanced Security Scorecard
• Financial Perspective
• Customer Perspective
• Internal Process Perspective
• Learning and Growth Perspective
• Organizational Considerations for the Balanced Security Scorecard
• Cascading Scorecards Build Bridges
• Balancing Accountability anbd Acceptance
• Speeding Acceptance Using Mock-Ups
  
• Summary
  

A long-needed book for security professionals.

The security professionals have too long been running around and tried to scare people with emotional appeals. This book gives a more business oriented view of security, by showing how to both measure it and how to present it.

The connection to BSC is an excellent add-on, which would make it acceptable to the most hard-nosed senior executives.

Strongly recommended for security professionals, especially if you don't have a degree in management.