EUIST

Related -Security metrics and Small- and Medium-Sized Enterprises (SMEs): Quo Vadis Previousl we discussed how security-related risks must be categorized to get a better handle on them. We proposed a graphic framework that could be used here: – Early Warning System (EWS) – Categorizing the risks Here we expand upon this framework and develop a [...]

[Read more →]

Recently we have addressed various issues regarding securitymetrics, such as: – CyTRAP Labs – guide – developing IT security metrics that work for you – Managing risks while getting your CEO’s attention – communication matters – Security metrics – do you know what your boss wants? – CyTRAP Labs – guide- the seven deadly sins [...]

[Read more →]

As we all have learned, getting attention (and budget) from top executives for such efforts as risk and security mitigation is a challenge, see here: CyTRAP Labs guide to effective IT risk management – being conceptually thorough while keeping it simple CyTRAP Labs – guide – developing IT security metrics that work for you Managing [...]

[Read more →]

Your email:  We have previously addressed how difficult it is to develop metrics that are not only reliable but also valid and have a strategic focus – meaning C-level executives do care about getting such numbers that relate to matters the care about (e.g., new markets, strategy, bottom line): – CyTRAP Labs – guide – [...]

[Read more →]

Your email:  Since 2001 we have been addressing security metric issues: – Best Practice – Benchmarks – Metrics – Ten Worst Security Practices – LIB- NIST – Pub 800-55 – Using Metrics to Measure Security Controls, Processes and Procedures – Week 33 – Lib 1 – NIST Guidelines – Security Metrics that Work? Recently we [...]

[Read more →]

As you might have expected, there is no consensus on what security metrics should be used for measuring security effectiveness and benchmarking the enteprise. 2004-04-06 The Robert Frances Group reported in CSO magazine that the companies it surveyed used these metrics to assess security effectiveness: Which of the following key data elements does your organization [...]

[Read more →]