Analytics

6/9/2015
10:30 AM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Security Metrics: Its All Relative

What a haircut taught me about communicating the value of security to executives and non-security professionals.

The other day, I learned a great lesson about security metrics while getting a haircut. Initially, this may sound like a bit of an odd statement, but I promise it will make sense in the end. The woman cutting my hair asked me: “Should I cut off one-half inch?” Putting aside my preference for the metric system and dislike of the imperial system, I found this question to be quite fascinating.

To the woman cutting my hair, the question was a scientific one. Depending on how I answered, she would choose the appropriate scissors and clippers and proceed accordingly. From my perspective, however, the question was meaningless, or at the very least, difficult to parse. I didn’t know how to answer because I have no idea what length I like my hair -- at least not in absolute terms like inches or centimeters.

What does this have to do with security metrics? Let’s begin to answer that question by examining the definition of the word “metrics.” A metric is defined as “a method of measuring something, or the results obtained from this.” In order for me to understand and subsequently answer the question, I had to translate into a method of measurement that I could understand. After a small amount of research, I learned that hair generally grows one-quarter inch per month. In the context of this example, the question translated into relative terms I could understand would be: “Should I cut off two months of growth?”

As security professionals, we tend to get used to a certain way of thinking, speaking, measuring, and communicating. What we sometimes forget is that to many people (most notably leaders such as our executives and boards), the value we bring is not always easy to understand. It’s not that we aren’t working hard, doing more with less, adding value to the organizations we serve, and sometimes working small miracles. Rather, it’s that we struggle to translate those efforts into a meaningful context. What’s missing is a way for us to communicate our value in terms that non-security professionals can understand and evaluate.

To illustrate this point, let’s work through some examples. Many security organizations regularly report a familiar set of metrics to their leadership. These metrics tend to be absolute in nature. What do I mean by that? Absolute metrics are metrics that involve quantitative measures that are not relative to or dependent on anything else. For example, absolute metrics that some of us might be familiar with include:

  • Number of infected endpoints during a specific time window
  • Number of brute force attempts during a specific time window
  • Average length of time a ticket remains in the “open” or “unresolved” state

Although these metrics may seem familiar, they represent a critical disconnect with the prioritized list of risks and threats security-aware leaders are most concerned with. Preventing damage to the organization from those very risks and threats is likely a top priority for these individuals on a daily basis. It is against those priorities that the security-aware leader will likely evaluate the successes of his or her security organization, along with determining areas for improvement.

When we look at the subject of metrics from this perspective, it becomes a bit easier to see why traditional, absolute metrics do not fit the task at hand. What’s missing from the discussion is a mapping between the tactical and operational work going on within the security organization and the strategic view taken by leaders. Enter relative metrics.

Relative metrics are metrics that involve quantitative measures that are “translated” or “mapped” to the priorities of leadership. Relative metrics allow the security organization to effectively measure and communicate its successes and areas for improvement in terms that leadership can internalize. Taking the three illustrative absolute metrics referenced above and converting them into relative metrics might result in the following examples:

  • Amount of sensitive data exfiltrated via infected endpoints during a specific time window
  • Risk and exposure as a result of critical assets successfully compromised via brute force attacks during a specific time window
  • Median-time-to-remediation (MTTR)

As we can see, these relative metrics more precisely speak the language of our leaders. They do this by taking the absolute metrics and mapping them to the risks and threats that most concern our leadership. Of course, each organization will have its own unique concerns. That prioritized list should guide the development of relative metrics inside each organization.

It’s hard to imagine how a conversation between two people speaking two mutually unintelligible languages could result in the productive exchange of ideas. Yet, in the security world, we often live this very experience daily. Tactically and operationally focused security teams speak metrics that are unintelligible to their strategically focused leaders. In my experience, in order for effective communication to occur, everyone needs to be speaking the same language. Metrics and measurement are no exception.

Josh is an experienced information security leader with broad experience building and running Security Operations Centers (SOCs). Josh is currently co-founder and chief product officer at IDRRA. Prior to joining IDRRA, Josh served as vice president, chief technology officer, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Plumber
50%
50%
Plumber,
User Rank: Apprentice
3/21/2017 | 5:13:15 PM
Re: Plumber Hair Cuts
I need one myself!!!
baller188
100%
0%
baller188,
User Rank: Apprentice
3/14/2017 | 6:03:51 AM
Trading Hair Cuts
Great story telling, i was smiling all the way through. In fact i'm thinking of going to get a hair cut.
Enrico Fontan
50%
50%
Enrico Fontan,
User Rank: Strategist
6/16/2015 | 11:05:20 AM
Change context
I agree with your thoughts. Usually the management needs only smart indicators of security exposures (ex: green/red traffic light) not technical discussions about trends, security exposures and so on.

A Security Manager needs to be able to translate security concepts in different context.

This will bring some responsibilities. What if translation goes wrong?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/9/2015 | 2:01:39 PM
Drawing Parallels
I agree with this article to an extent. There are two distinct languages between security folk and non-security folk however there is commonality between them. It's more that people are bilingual. They have their craft and their language. Where we fail is drawing parallels to non-security people from our commonality (language). Same as a teacher, if you cannot get a person to understand how if affects them or reach them on an interest level it is difficult for a person to absorb a lesson. You could talk about data exfiltration and its intricacies all day but until you explain that peoples social security numbers could be used through this process for nefarious means its unlikely you will get through. We have the ability, we just need to harness it in a more apt manner.
Facebook Aims to Make Security More Social
Kelly Sheridan, Associate Editor, Dark Reading,  2/20/2018
SEC: Companies Must Disclose More Info on Cybersecurity Attacks & Risks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  2/22/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.