Application Security

12/21/2018
04:15 PM
50%
50%

7 Business Metrics Security Pros Need to Know

These days, security has to speak the language of business. These KPIs will get you started.
Previous
1 of 8
Next

(Image: Moritz320)

Peter Drucker, aka the founder of modern management, is credited with writing, "If you can't measure it, you can't improve it." Over time, that has been broadened to, "If you can't measure it, you can't manage it," a statement that is taken as holy writ for most modern executives.

Indeed, business in the 21st century is all about metrics. Cybersecurity has plenty, measuring everything from port probes to login attempts. It's expected that cybersecurity managers will have a good handle on all of these metrics and know what they're saying about their organizations. But in today's business organization, these security metrics aren't enough.

In order to protect the business, security has to speak the language of business. The last decade has seen a growing, if sometimes grudging, acknowledgment of this by security professionals. The question for many security pros is, "Which business metrics should I know?"

Each organization may have its own unique key performance indicators (KPIs) to take into consideration. But certain metrics matter regardless of the particular business. To cover all of them is the subject of an MBA, but we've put together a list that includes some basics, some that might escape first notice, and some that have a particular interest from a security perspective.

In each case, these are metrics that cybersecurity pros should understand and pay attention to. Do you use them in your security practice? What other metrics do you think should be on this list? Let us know in the comments.  

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ThomasMaloney
50%
50%
ThomasMaloney,
User Rank: Apprentice
1/16/2019 | 4:11:30 AM
Always improving ourselves
We do not become an expert overnight and even when we have reached a certain standard, there is always room for improvement. There are always guidelines or metrics that we can fall back on even if we have reached an expert level. We should always allow ourselves to have room for improvement in order for us to remain relevant in the sector and know any progressive updates.
mark@polaris
50%
50%
[email protected],
User Rank: Apprentice
1/15/2019 | 9:59:29 PM
Re: Productivity/accessibility as security considerations (or not)
Interesting feedback from others reading the article. Here's my take:

Productivity should be measured as there is a lot that can be learned IF they are done correctly. Hours worked is another interesting metric but is not something that should be measured daily or weekly, at least in my opinion. This would start to drive the wrong behaviors on the floor. As for the Net Promoter Score, I don't think that I've ever really agreed with the metric at least from any process that can game it (and most that I've seen, can.) I just don't think that it's very useful in a cyber security setting. I agree with the Lead to Client conversion rate but think that a cyber security operation should focus more on cycle time and quality of hand off to them if they are concerned about inbound work. By looking at these two areas a tremendous amount can be learned and improved on. Personally, I think that cyber security has a very long way to go when it comes to metrics and improvement. The legitimate need to focus primarily on technology means that people and process are not focused on as much as they should be.
EdwardThirlwall
50%
50%
EdwardThirlwall,
User Rank: Apprentice
1/3/2019 | 9:39:01 AM
Re: Productivity/accessibility as security considerations (or not)
I think that a lot of businesses forget about customer retention a lot. Because I run a business that builds its whole premise around making sure that a customer sticks with you once they've signed on, I think I'm a little qualified to make the comparison. It's not just about giving them a good price for the goods they've placed in storage with you but making sure your services are up to par so they don't want to move away from your company!
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/31/2018 | 10:37:35 PM
Productivity/accessibility as security considerations (or not)
The operating productivity (a.k.a. accessibility) metric is a tough and debatable one. On the one hand, security and accessibility are polar opposites of each other -- and, as such, it can be fair to assign security to the security teams and accessibility to the operations/business teams...and then let the C-suite make the appropriate decisions from there (in other words, letting both sides fully advocate/fight it out, and let the appropriate decision-makers earn their decision-making paychecks). OTOH, security professionals fully have to account for the possibility that overly burdensome/draconian security policies may perversely incentivize bad security in the long run.

I'd be interested to see what other readers think on this.
ashwinK123
50%
50%
ashwinK123,
User Rank: Apprentice
12/24/2018 | 3:15:38 AM
ashwin
Thank you to this post!
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.
CVE-2013-7469
PUBLISHED: 2019-02-21
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2018-20146
PUBLISHED: 2019-02-21
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVE-2019-5727
PUBLISHED: 2019-02-21
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.