Measuring Database Security

How much does it cost to secure your database, and how do you calculate that? One of the more vexing problems in security is the lack of metrics models for measuring and optimizing security efforts. Without frameworks and metrics to measure the efficiency and effectiveness of security programs, it's difficult both to improve processes and to communicate our value to nontechnical decision makers."What's the ROI for this investment?" is a favorite question among by senior management and finance groups. It's a question that does not have an answer, and stymies the justification of spending time or purchasing tools to secure databases.

Itemizing costs and justifying efforts is a problem all IT departments have. Being able to assess costs, gauge time and resource requirements, and determine gaps is important in communicating project status with upper management. To address this community issue, Project Quant for Database Security was started. This is an open, community-driven, vendor-neutral effort with the models for database security free to the public.

The first step was to analyze how businesses go about securing their databases. We quickly discovered this is not a single process, but one that comprises of a dozen or more efforts. Worse, there really is no formal patch management, vulnerability assessment, or configurations management process for databases. With the goal to provide tangible metrics, we need to examine each of these efforts individually, breaking them into discrete tasks small enough to accurately assign quantitative metrics.

Building out individual processes for assessment, monitoring, auditing, and patching provided the granularity necessary. It allowed individual organization to mix and match processes, tailoring to their respective complexity, and assign time and resources that reflected their needs.

As with most open efforts, the more database and security professionals who participate, the better the results. And the more participating people and organizations, the better we can reflect DBA and IT efforts. Project Quant for database security is still under way, with the entire effort open to comments and critique. If you are interested in contributing to this effort, then you are invited to participate.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading.