EUIST

Related
-Security metrics and Small- and Medium-Sized Enterprises (SMEs): Quo Vadis
Previousl we discussed how security-related risks must be categorized to get a better handle on them. We proposed a graphic framework that could be used here:
- Early Warning System (EWS) – Categorizing the risks
Here we expand upon this framework and develop a graphic overview in somewhat [...]

[Read more →]

Recently we have addressed various issues regarding securitymetrics, such as:
- CyTRAP Labs – guide – developing IT security metrics that work for you
- Managing risks while getting your CEO’s attention – communication matters
- Security metrics – do you know what your boss wants?
- CyTRAP Labs – guide- the seven deadly sins of security metrics
Security metrics [...]

[Read more →]

As we all have learned, getting attention (and budget) from top executives for such efforts as risk and security mitigation is a challenge, see here:
CyTRAP Labs guide to effective IT risk management – being conceptually thorough while keeping it simple
CyTRAP Labs – guide – developing IT security metrics that work for you
Managing [...]

[Read more →]

Your email: 

We have previously addressed how difficult it is to develop metrics that are not only reliable but also valid and have a strategic focus – meaning C-level executives do care about getting such numbers that relate to matters the care about (e.g., new markets, strategy, bottom line):
- CyTRAP Labs – guide – developing IT [...]

[Read more →]

Your email: 

Since 2001 we have been addressing security metric issues:
- Best Practice – Benchmarks – Metrics – Ten Worst Security Practices
- LIB- NIST – Pub 800-55 – Using Metrics to Measure Security Controls, Processes and Procedures
- Week 33 – Lib 1 – NIST Guidelines – Security Metrics that Work?
Recently we have picked it [...]

[Read more →]

As you might have expected, there is no consensus on what security metrics should be used for measuring security effectiveness and benchmarking the enteprise.
2004-04-06 The Robert Frances Group reported in CSO magazine that the companies it surveyed used these metrics to assess security effectiveness:

Which of the following key data elements does your organization [...]

[Read more →]