Here is some info on security metrics from the analytical/statistical viewpoint
http://www.sse-cmm.org/metrics.htm http://www.fcw.com/fcw/articles/2000/0619/pol-metrics-06-19-00.asp http://www.metagroup.com/metaview/mv0314/mv0314.html http://cs-www.ncsl.nist.gov/csspab/june13-15/metrics_report.doc Matt (Plus-Minus Rating +5) :) -----Original Message----- From: Led Slinger [mailto:[EMAIL PROTECTED]] Sent: Thursday, June 06, 2002 12:04 PM To: [EMAIL PROTECTED] Subject: Security Program Targets I wanted to throw this question out to a broad range of security professionals because I have been struggling with this for quite some time. The question is simple, but the answers elude me. How does one measure the success of a security program? I find it relatively simple to identify a risk and mitigate it using technology, but when corporate culture and business 'needs' butt heads with security requirements, I find myself losing more often than not. Simple things such as DMZ environments versus punch throughs to forcing patches on developers. They are quite simple to understand and to implement, and the cost is not a factor, it's plain and simple 'Time is money'. But rarely does the 'Time is Money' come into play when rebuilding a box due to NIMDA or some other tragedy du jour. OK, that's mostly bitchin about life, but where I'm trying to go with this is; If you develop a sound security program, implement it both tactically and strategically, how do you really measure its success? The number of incidents may go down, but even with a solid plan, the sheer number of new exploits and the fast rate of virus propagation may make the incident numbers go up. This really isn't a measure of success or failure in my book. Any suggestions, recommendation or generally information would be tremendously helpful! Cheers, Leds! -- There's nothing wrong with Windows until you install it........
