Security Metrics - 23 Resources

Metrics are tools designed to facilitate decision-making and improve performance and accountability through collection, analysis, and reporting of relevant performance-related data. IT Security Metrics are metrics based on IT security performance goals and objectives. [Source: NIST SP 800-55]

Suggested Resources

• Center for Internet Security (CIS) Consensus Information Security Metrics: Organizations struggle to make cost-effective security investment decisions; information security professionals lack widely accepted and unambiguous metrics for decision support. CIS established a consensus group of industry experts to address this need, resulting in a set of Consensus Security Metrics and data set definitions that can be used across organizations to collect and analyze data on security process and performance outcomes. Currently, the consensus group has developed metrics covering the following business functions: Application Security, Configuration Change Management, Financial, Incident Management, Patch Management, and Vulnerability Management.
• NIST Special Publication (SP) 800-55: Performance Measurement Guide for Information Security
• "Security Metrics: A Solution in Search of a Problem": This 2008 EDUCAUSE Quarterly article by Joel Rosenblatt describes how the creation and collection of appropriate metrics can enhance an institution's security program. Learn about some potential metrics in the following areas: policy and compliance, network and machine monitoring, outreach and education, legal compliance, authorization and authentication, asset protection, and privacy.
• "Recommended Reading–Security Metrics: Replacing Fear, Uncertainty, and Doubt": In this 2008 EDUCAUSE Quarterly article, Joel Rosenblatt reviews Andrew Jaquith's book, Security Metrics: Replacing Fear, Uncertainty, and Doubt.