-
Research
and Publications
Current Issue
May/June 2013
EDUCAUSE ReviewPublications
-
Conferences
and Events
Annual Conference
October 15–18, 2013
Register now!Events for all Levels and Interests
Whether you're looking for a conference to attend face-to-face to connect with peers, or for an online event for team professional development, see what's upcoming.
-
Career
Development
EDUCAUSE Institute
Leadership/Management Programs
Explore MoreCareer Center
Leadership and Management Programs
EDUCAUSE Institute
Advanced Programs
Project Management
Jump Start Your Career Growth
Explore EDUCAUSE professional development opportunities that match your career aspirations and desired level of time investment through our interactive online guide.
-
Focus Areas
and InitiativesLatest Topics
EDUCAUSE organizes its efforts around three IT Focus Areas
Join These Programs If Your Focus Is
-
Connect
and ContributeFind Others
Get on the Higher Ed IT Map
Employees of EDUCAUSE member institutions and organizations are invited to create individual profiles.
-
About
EDUCAUSE
Subscribe
Filter by type
Filter by Publications
Filter by Presentations
Filter by Library Taxonomy
- Security Metrics [x]
- Cybersecurity (25)
- Security Management (25)
- Security Risk Assessment and Analysis (9)
- Security Planning (7)
- Information Technology Management and Leadership (6)
- Benchmarking (4)
- IT Effectiveness (4)
- Incident Handling and Response (4)
- Policy and Law (4)
- Cybersecurity Policy (3)
- Federal Policy and Law (3)
- Security Awareness (3)
- Campus Policies (2)
- Campus Policy and Law (2)
- Security Policies (2)
- Teaching and Learning (2)
- Metrics (1)
- Planning (1)
- Privacy (1)
Metrics are tools designed to facilitate decision-making and improve performance and accountability through collection, analysis, and reporting of relevant performance-related data. IT Security Metrics are metrics based on IT security performance goals and objectives. [Source: NIST SP 800-55]
Suggested Resources
- HEISC Resource: A Guide to Effective Security Metrics (part of the Information Security Guide)
- Center for Internet Security (CIS) Consensus Information Security Metrics: Organizations struggle to make cost-effective security investment decisions, in part because information security professionals lack widely accepted, unambiguous metrics for supporting their decisions.To address the need for clear security metrics, CIS established a consensus group of industry experts. The result? A set of Consensus Security Metrics and data set definitions that can be used across organizations to collect and analyze data on security outcomes and process performance.
- "Cybersecurity: When Will We Know If What We Are Doing Is Working?": This 2009 EDUCAUSE Review article by Clint Kreitner proposes a conceptual vision/framework for three essential elements: 1) a widely accepted definition of success, 2) consensus metrics for measuring progress toward success, and 3) a comprehensive feedback learning mechanism.
- NIST Interagency/Internal Report (IR) 7564: Directions in Security Metrics Research
- NIST Special Publication (SP) 800-55: Performance Measurement Guide for Information Security
- "Security Metrics: A Solution in Search of a Problem": This 2008 EDUCAUSE Quarterly article by Joel Rosenblatt describes how the creation and collection of appropriate metrics can enhance an institution's security program. Learn about some potential metrics in the following areas: policy and compliance, network and machine monitoring, outreach and education, legal compliance, authorization and authentication, asset protection, and privacy.
- "Recommended Reading–Security Metrics: Replacing Fear, Uncertainty, and Doubt": In this 2008 EDUCAUSE Quarterly article, Joel Rosenblatt reviews Andrew Jaquith's book, Security Metrics: Replacing Fear, Uncertainty, and Doubt.
Updated October 2012
Library Items on this Topic
EDUCAUSE Library Items for Security Metrics
-
Recommended Reading
-
August 4, 2008
Recommended Reading EDUCAUSE Quarterly, vol. 31, no. 3 (July–September 2008) Security Metrics: Replacing Fear, Uncertainty, and Doubt Andrew Jaquith Addison Wesley, 2007…
-
Security Metrics: A Solution in Search of a Problem
-
August 4, 2008
© 2008 Joel Rosenblatt. The text of this article is licensed under the Creative Commons Attribution-Share Alike 3.0 license ( http://creativecommons.org/licenses/by-sa/3.0/ ). EDUCAUSE Qu…
-
Cybersecurity Research Challenges
-
May 8, 2008
Today's most prevalent and widely discussed attacks exploit code-level flaws such as buffer overruns and type-invalid input. We need to anticipate tomorrow's attacks and think beyond buff…
-
Incident Management Capability Metrics
-
September 19, 2007
The CERT CSIRT Development Team has introduced a method to evaluate and improve an organization's capability for managing computer security incidents. This method uses a set of incident mana…
-
Complete Guide to Security and Privacy Metrics: Measuring Regulatory Compliance, Operational Resilience, and ROI - Book Review
-
August 29, 2007
Complete Guide to Security and Privacy Metrics: Measuring Regulatory Compliance, Operational Resilience, and ROI Debra S. Herrmann Auerbach Publications, 2007 $119.95 (hardcover), 824 pp…
-
A Few Good Metrics
-
July 21, 2005
Information security metrics don't have to rely on heavy-duty math to be effective, but they also don't have to be dumbed down to red, yellow, green. Here are five smart measurements—…
-
A Guide to Security Metrics
-
June 22, 2006
The pressure is on. Various surveys indicate that over the past several years computer security has risen in priority for many organizations. Spending on IT security has increased significantly i…
-
Guide for Developing Performance Metrics for Information Security: Recommendations of the National Institute of Standards and Technology
-
May 19, 2006
This publication focuses on developing and implementing information security metrics for an information security program. The processes and methodologies described in this guidance link informati…
-
Incident Tracking and Reporting
-
April 12, 2007
|
A session at the Security 2007
The University of Florida and the University of Pennsylvania both regularly generate summary reports of computer incidents for information security managers. The reports help identify units that ne…
-
Effective Security Metrics
-
April 11, 2007
|
A session at the Security 2007
This presentation will show how the University of Pittsburgh successfully uses incident, operational, and compliance metrics to demonstrate the effectiveness of its security controls, as well as to…
