-
Research
and Publications
Current Issue
March/April 2013
EDUCAUSE ReviewPublications
-
Conferences
and Events
Annual Conference
October 15–18, 2013
Save the date!Events for all Levels and Interests
Whether you're looking for a conference to attend face-to-face to connect with peers, or for an online event for team professional development, see what's upcoming.
-
Career
Development
EDUCAUSE Institute
Leadership/Management Programs
Explore MoreCareer Center
Leadership and Management Programs
EDUCAUSE Institute
Advanced Programs
Project Management
Jump Start Your Career Growth
Explore EDUCAUSE professional development opportunities that match your career aspirations and desired level of time investment through our interactive online guide.
-
Focus Areas
and InitiativesLatest Topics
EDUCAUSE organizes its efforts around three IT Focus Areas
Join These Programs If Your Focus Is
-
Connect
and ContributeFind Others
Get on the Higher Ed IT Map
Employees of EDUCAUSE member institutions and organizations are invited to create individual profiles.
-
About
EDUCAUSE
Subscribe
Filter by type
Filter by Publications
Filter by Presentations
Filter by Library Taxonomy
- Security Metrics [x]
- Cybersecurity (24)
- Security Management (24)
- Security Risk Assessment and Analysis (8)
- Security Planning (7)
- Information Technology Management and Leadership (6)
- Benchmarking (4)
- IT Effectiveness (4)
- Incident Handling and Response (4)
- Policy and Law (4)
- Cybersecurity Policy (3)
- Federal Policy and Law (3)
- Security Awareness (3)
- Campus Policies (2)
- Campus Policy and Law (2)
- Security Policies (2)
- Teaching and Learning (2)
- Metrics (1)
- Planning (1)
- Privacy (1)
Metrics are tools designed to facilitate decision-making and improve performance and accountability through collection, analysis, and reporting of relevant performance-related data. IT Security Metrics are metrics based on IT security performance goals and objectives. [Source: NIST SP 800-55]
Suggested Resources
- HEISC Resource: A Guide to Effective Security Metrics (part of the Information Security Guide)
- Center for Internet Security (CIS) Consensus Information Security Metrics: Organizations struggle to make cost-effective security investment decisions, in part because information security professionals lack widely accepted, unambiguous metrics for supporting their decisions.To address the need for clear security metrics, CIS established a consensus group of industry experts. The result? A set of Consensus Security Metrics and data set definitions that can be used across organizations to collect and analyze data on security outcomes and process performance.
- "Cybersecurity: When Will We Know If What We Are Doing Is Working?": This 2009 EDUCAUSE Review article by Clint Kreitner proposes a conceptual vision/framework for three essential elements: 1) a widely accepted definition of success, 2) consensus metrics for measuring progress toward success, and 3) a comprehensive feedback learning mechanism.
- NIST Interagency/Internal Report (IR) 7564: Directions in Security Metrics Research
- NIST Special Publication (SP) 800-55: Performance Measurement Guide for Information Security
- "Security Metrics: A Solution in Search of a Problem": This 2008 EDUCAUSE Quarterly article by Joel Rosenblatt describes how the creation and collection of appropriate metrics can enhance an institution's security program. Learn about some potential metrics in the following areas: policy and compliance, network and machine monitoring, outreach and education, legal compliance, authorization and authentication, asset protection, and privacy.
- "Recommended Reading–Security Metrics: Replacing Fear, Uncertainty, and Doubt": In this 2008 EDUCAUSE Quarterly article, Joel Rosenblatt reviews Andrew Jaquith's book, Security Metrics: Replacing Fear, Uncertainty, and Doubt.
Updated October 2012
Library Items on this Topic
EDUCAUSE Library Items for Security Metrics
-
Security Metrics
-
Security Metrics True Metrics are tools designed to facil…
-
IT Service Metrics 101
-
January 28, 2013
Key Takeaways These guidelines to service metrics explain what to measure and how, when, and why to measure it. Trends reveal the most about services and performan…
-
Metrics 201: Benchmarking and Security Metrics
-
May 15, 2012
Whether you're new to metrics or a metrics master, this session is for you. We'll help you get started with using a metrics development methodology. Then, we'll look at some examples…
-
Benchmarking Security Data with the Redesigned EDUCAUSE Core Data Service
-
April 4, 2011
In 2011, EDUCAUSE will launch an updated Core Data Service based on extensive member feedback. Core data consultant Dan Updegrove will explain enhancements, including a new security survey module, …
-
Measuring Security Awareness as a Metric
-
April 6, 2011
|
A session at the Security Professionals Conference 2011
In the face of regular news reports of serious data breaches, and best practices outlining the need for security awareness programs, information security departments want to demonstrate the effecti…
-
A Guide to Security Metrics
-
April 13, 2010
|
A session at the Security 2010
In the face of regular, high-profile news reports of serious security breaches, as well as intense scrutiny of institutional costs, security managers are more than ever being held accountable for d…
-
Directions in Security Metrics Research
-
August 20, 2009
More than 100 years ago, Lord Kelvin insightfully observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made va…
-
Cybersecurity: When Will We Know If What We Are Doing Is Working?
-
September 4, 2009
© 2009 Clint Kreitner. The text of this article is licensed under the Creative Commons Attribution-NonCommercial-NoDerivs 3.0 License ( http://creativecommons.org/licenses/by-nc-nd/3.0/ …
-
Building a Cybersecurity Operations Center
-
April 21, 2009
|
A session at the Security 2009
Three IT security offices (Virginia Tech, Penn State, and Purdue) are building a cybersecurity operations center (CSOC) that will be the focal point for each institution's campus-wide cybersec…
-
Recommended Reading
-
August 4, 2008
Recommended Reading EDUCAUSE Quarterly, vol. 31, no. 3 (July–September 2008) Security Metrics: Replacing Fear, Uncertainty, and Doubt Andrew Jaquith Addison Wesley, 2007…
