Analytics

6/9/2015
10:30 AM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Security Metrics: Its All Relative

What a haircut taught me about communicating the value of security to executives and non-security professionals.

The other day, I learned a great lesson about security metrics while getting a haircut. Initially, this may sound like a bit of an odd statement, but I promise it will make sense in the end. The woman cutting my hair asked me: “Should I cut off one-half inch?” Putting aside my preference for the metric system and dislike of the imperial system, I found this question to be quite fascinating.

To the woman cutting my hair, the question was a scientific one. Depending on how I answered, she would choose the appropriate scissors and clippers and proceed accordingly. From my perspective, however, the question was meaningless, or at the very least, difficult to parse. I didn’t know how to answer because I have no idea what length I like my hair -- at least not in absolute terms like inches or centimeters.

What does this have to do with security metrics? Let’s begin to answer that question by examining the definition of the word “metrics.” A metric is defined as “a method of measuring something, or the results obtained from this.” In order for me to understand and subsequently answer the question, I had to translate into a method of measurement that I could understand. After a small amount of research, I learned that hair generally grows one-quarter inch per month. In the context of this example, the question translated into relative terms I could understand would be: “Should I cut off two months of growth?”

As security professionals, we tend to get used to a certain way of thinking, speaking, measuring, and communicating. What we sometimes forget is that to many people (most notably leaders such as our executives and boards), the value we bring is not always easy to understand. It’s not that we aren’t working hard, doing more with less, adding value to the organizations we serve, and sometimes working small miracles. Rather, it’s that we struggle to translate those efforts into a meaningful context. What’s missing is a way for us to communicate our value in terms that non-security professionals can understand and evaluate.

To illustrate this point, let’s work through some examples. Many security organizations regularly report a familiar set of metrics to their leadership. These metrics tend to be absolute in nature. What do I mean by that? Absolute metrics are metrics that involve quantitative measures that are not relative to or dependent on anything else. For example, absolute metrics that some of us might be familiar with include:

  • Number of infected endpoints during a specific time window
  • Number of brute force attempts during a specific time window
  • Average length of time a ticket remains in the “open” or “unresolved” state

Although these metrics may seem familiar, they represent a critical disconnect with the prioritized list of risks and threats security-aware leaders are most concerned with. Preventing damage to the organization from those very risks and threats is likely a top priority for these individuals on a daily basis. It is against those priorities that the security-aware leader will likely evaluate the successes of his or her security organization, along with determining areas for improvement.

When we look at the subject of metrics from this perspective, it becomes a bit easier to see why traditional, absolute metrics do not fit the task at hand. What’s missing from the discussion is a mapping between the tactical and operational work going on within the security organization and the strategic view taken by leaders. Enter relative metrics.

Relative metrics are metrics that involve quantitative measures that are “translated” or “mapped” to the priorities of leadership. Relative metrics allow the security organization to effectively measure and communicate its successes and areas for improvement in terms that leadership can internalize. Taking the three illustrative absolute metrics referenced above and converting them into relative metrics might result in the following examples:

  • Amount of sensitive data exfiltrated via infected endpoints during a specific time window
  • Risk and exposure as a result of critical assets successfully compromised via brute force attacks during a specific time window
  • Median-time-to-remediation (MTTR)

As we can see, these relative metrics more precisely speak the language of our leaders. They do this by taking the absolute metrics and mapping them to the risks and threats that most concern our leadership. Of course, each organization will have its own unique concerns. That prioritized list should guide the development of relative metrics inside each organization.

It’s hard to imagine how a conversation between two people speaking two mutually unintelligible languages could result in the productive exchange of ideas. Yet, in the security world, we often live this very experience daily. Tactically and operationally focused security teams speak metrics that are unintelligible to their strategically focused leaders. In my experience, in order for effective communication to occur, everyone needs to be speaking the same language. Metrics and measurement are no exception.

Josh (Twitter: @ananalytical) is an experienced information security leader with broad experience building and running Security Operations Centers (SOCs). Josh is currently co-founder and chief product officer at IDRRA and also serves as security advisor to ExtraHop. Prior to ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Plumber
50%
50%
Plumber,
User Rank: Apprentice
3/21/2017 | 5:13:15 PM
Re: Plumber Hair Cuts
I need one myself!!!
baller188
100%
0%
baller188,
User Rank: Apprentice
3/14/2017 | 6:03:51 AM
Trading Hair Cuts
Great story telling, i was smiling all the way through. In fact i'm thinking of going to get a hair cut.
Enrico Fontan
50%
50%
Enrico Fontan,
User Rank: Strategist
6/16/2015 | 11:05:20 AM
Change context
I agree with your thoughts. Usually the management needs only smart indicators of security exposures (ex: green/red traffic light) not technical discussions about trends, security exposures and so on.

A Security Manager needs to be able to translate security concepts in different context.

This will bring some responsibilities. What if translation goes wrong?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/9/2015 | 2:01:39 PM
Drawing Parallels
I agree with this article to an extent. There are two distinct languages between security folk and non-security folk however there is commonality between them. It's more that people are bilingual. They have their craft and their language. Where we fail is drawing parallels to non-security people from our commonality (language). Same as a teacher, if you cannot get a person to understand how if affects them or reach them on an interest level it is difficult for a person to absorb a lesson. You could talk about data exfiltration and its intricacies all day but until you explain that peoples social security numbers could be used through this process for nefarious means its unlikely you will get through. We have the ability, we just need to harness it in a more apt manner.
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Risk, Privacy, and Information Security Officer, AvePoint, Inc.,  8/20/2018
Ohio Man Sentenced To 15 Months For BEC Scam
Dark Reading Staff 8/20/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15667
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. It registers and uses the airmail:// URL scheme. The "send" command in the URL scheme allows an external application to send arbitrary emails from an active account without authentication. The handler has no restriction on who can...
CVE-2018-15668
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. The "send" command in the airmail:// URL scheme allows an external application to send arbitrary emails from an active account. URL parameters for the "send" command with the "attachment_" prefix designate atta...
CVE-2018-15669
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that requests from HTMLIFrameElements are blacklisted. However, other sub-classes of HTMLFrameOwnerElements are...
CVE-2018-15670
PUBLISHED: 2018-08-21
An issue was discovered in Bloop Airmail 3 3.5.9 for macOS. Its primary WebView instance implements "webView:decidePolicyForNavigationAction:request:frame:decisionListener:" such that OpenURL is the default URL handler. A navigation request is processed by the default URL handler only if t...
CVE-2018-15671
PUBLISHED: 2018-08-21
An issue was discovered in the HDF HDF5 1.10.2 library. Excessive stack consumption has been detected in the function H5P__get_cb() in H5Pint.c during an attempted parse of a crafted HDF file. This results in denial of service.