Passing the Sniff Test: Security Metrics and Measures
Cigital dishes dirt on top security metrics that don’t work well, why they’re ineffective and which measurable to consider instead.
October 23, 2015
Security metrics are one of the key pillars of establishing a mature cybersecurity program. We’ve spilled a lot of digital ink over the years at Dark Reading discussing some of the top security metrics that organizations should consider collecting and analyzing. But are all security metrics good ones? According to Caroline Wong, security initiative director at Cigital, the short answer is, ‘Nope!’ She’s seen organizations waste resources on measuring things that don’t really matter to the business and do nothing to help drive improvement.
“I've really been doing security metrics for about ten years, so I've had more time to think about stuff,” she says. “And one of the things that I've realized is that there are some metrics which organizations track that I really just don't think are useful.”
Caroline gave us the lowdown on metrics effectiveness. She started by offering some key sniff tests for determining if your metric is a stinker. Then she offered up some examples of ineffective metrics, as well as alternatives that will better help move the needle for security.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024