Operations
11/12/2016
09:00 AM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Security Metrics Checklist

Which metrics are the best indicators of a strong cybersecurity team? Experts say security pros should be recording and reporting these data points to demonstrate their success.
Previous
1 of 9
Next

Image Source: Shutterstock

Image Source: Shutterstock

It's easy to assume the best sign of security success is an absence of malicious activity. However, it's unrealistic for security pros to adopt the "no news is good news" approach to defense, security experts say.

Pete Lindstrom, vice president of security research with IDC's executive program, says the argument of "when we're successful, nothing happens," is the wrong approach. He says security departments tend to focus more on incidents and less on the "bits and bytes" of their programs.

CISOs, IT managers, and other security leaders need to record and report metrics to their CIOs and business executives to demonstrate the performance of their teams. But right now, most security teams lack definitive guidelines for gauging their success.

"The challenge with measuring security metrics is you never know what your security operations are not seeing," explains Jeff Schilling, chief of customer operations and security at Armor. This causes some metrics, like the number of hosts, to be false because teams have a tough time parsing false positives and don't know if they're finding all their infected hosts.

With so many unknowns, he continues, it's difficult to paint a full picture of performance. 

There are a few metrics today's security leaders are studying to gauge the success of their employees, explains Joseph Carson, CISSP, who handles EMEA product marketing and global strategic alliances for Thycotic. 

Some businesses measure their success by the number of security incidents they are experiencing and handling at any point in time, for instance. Others evaluate their system vulnerabilities by recording where their systems are patched, where they have been exposed, and the number of identified viruses trying to compromise systems within the organization, he says.

Security pros also evaluate the behavior of the perimeter, and record instances like firewall incidents and potentially dangerous websites. The number of solutions implemented is another common metric considered when evaluating security posture.

"Most of these things relate to different types of security measurements," Carson says. "But it also comes down to how well organizations can collect inventory from Web system applications and users in the environment." 

The problem with many of these metrics is they don't bridge the gap between business and security. Security pros should be focusing on metrics like the location and accuracy of information, and efficiency of alerts, to paint a better picture of their security strategies. 

"Many of the metrics we measure today don't translate into the business," Carson explains. "If an incident occurs, what is the business impact?" 

Here are eight key metrics for measuring the success (or failure) of a security program:

 

 

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance & Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Previous
1 of 9
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio