Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

6/9/2015
10:30 AM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Security Metrics: Its All Relative

What a haircut taught me about communicating the value of security to executives and non-security professionals.

The other day, I learned a great lesson about security metrics while getting a haircut. Initially, this may sound like a bit of an odd statement, but I promise it will make sense in the end. The woman cutting my hair asked me: “Should I cut off one-half inch?” Putting aside my preference for the metric system and dislike of the imperial system, I found this question to be quite fascinating.

To the woman cutting my hair, the question was a scientific one. Depending on how I answered, she would choose the appropriate scissors and clippers and proceed accordingly. From my perspective, however, the question was meaningless, or at the very least, difficult to parse. I didn’t know how to answer because I have no idea what length I like my hair -- at least not in absolute terms like inches or centimeters.

What does this have to do with security metrics? Let’s begin to answer that question by examining the definition of the word “metrics.” A metric is defined as “a method of measuring something, or the results obtained from this.” In order for me to understand and subsequently answer the question, I had to translate into a method of measurement that I could understand. After a small amount of research, I learned that hair generally grows one-quarter inch per month. In the context of this example, the question translated into relative terms I could understand would be: “Should I cut off two months of growth?”

As security professionals, we tend to get used to a certain way of thinking, speaking, measuring, and communicating. What we sometimes forget is that to many people (most notably leaders such as our executives and boards), the value we bring is not always easy to understand. It’s not that we aren’t working hard, doing more with less, adding value to the organizations we serve, and sometimes working small miracles. Rather, it’s that we struggle to translate those efforts into a meaningful context. What’s missing is a way for us to communicate our value in terms that non-security professionals can understand and evaluate.

To illustrate this point, let’s work through some examples. Many security organizations regularly report a familiar set of metrics to their leadership. These metrics tend to be absolute in nature. What do I mean by that? Absolute metrics are metrics that involve quantitative measures that are not relative to or dependent on anything else. For example, absolute metrics that some of us might be familiar with include:

  • Number of infected endpoints during a specific time window
  • Number of brute force attempts during a specific time window
  • Average length of time a ticket remains in the “open” or “unresolved” state

Although these metrics may seem familiar, they represent a critical disconnect with the prioritized list of risks and threats security-aware leaders are most concerned with. Preventing damage to the organization from those very risks and threats is likely a top priority for these individuals on a daily basis. It is against those priorities that the security-aware leader will likely evaluate the successes of his or her security organization, along with determining areas for improvement.

When we look at the subject of metrics from this perspective, it becomes a bit easier to see why traditional, absolute metrics do not fit the task at hand. What’s missing from the discussion is a mapping between the tactical and operational work going on within the security organization and the strategic view taken by leaders. Enter relative metrics.

Relative metrics are metrics that involve quantitative measures that are “translated” or “mapped” to the priorities of leadership. Relative metrics allow the security organization to effectively measure and communicate its successes and areas for improvement in terms that leadership can internalize. Taking the three illustrative absolute metrics referenced above and converting them into relative metrics might result in the following examples:

  • Amount of sensitive data exfiltrated via infected endpoints during a specific time window
  • Risk and exposure as a result of critical assets successfully compromised via brute force attacks during a specific time window
  • Median-time-to-remediation (MTTR)

As we can see, these relative metrics more precisely speak the language of our leaders. They do this by taking the absolute metrics and mapping them to the risks and threats that most concern our leadership. Of course, each organization will have its own unique concerns. That prioritized list should guide the development of relative metrics inside each organization.

It’s hard to imagine how a conversation between two people speaking two mutually unintelligible languages could result in the productive exchange of ideas. Yet, in the security world, we often live this very experience daily. Tactically and operationally focused security teams speak metrics that are unintelligible to their strategically focused leaders. In my experience, in order for effective communication to occur, everyone needs to be speaking the same language. Metrics and measurement are no exception.

Josh (Twitter: @ananalytical) is currently Director of Product Management at F5.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for nPulse Technologies until its acquisition by FireEye.  Prior to joining nPulse, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
baller188
100%
0%
baller188,
User Rank: Apprentice
3/14/2017 | 6:03:51 AM
Trading Hair Cuts
Great story telling, i was smiling all the way through. In fact i'm thinking of going to get a hair cut.
Enrico Fontan
50%
50%
Enrico Fontan,
User Rank: Strategist
6/16/2015 | 11:05:20 AM
Change context
I agree with your thoughts. Usually the management needs only smart indicators of security exposures (ex: green/red traffic light) not technical discussions about trends, security exposures and so on.

A Security Manager needs to be able to translate security concepts in different context.

This will bring some responsibilities. What if translation goes wrong?
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
6/9/2015 | 2:01:39 PM
Drawing Parallels
I agree with this article to an extent. There are two distinct languages between security folk and non-security folk however there is commonality between them. It's more that people are bilingual. They have their craft and their language. Where we fail is drawing parallels to non-security people from our commonality (language). Same as a teacher, if you cannot get a person to understand how if affects them or reach them on an interest level it is difficult for a person to absorb a lesson. You could talk about data exfiltration and its intricacies all day but until you explain that peoples social security numbers could be used through this process for nefarious means its unlikely you will get through. We have the ability, we just need to harness it in a more apt manner.
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-30477
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of replies to messages sent by outgoing webhooks to private streams meant that an outgoing webhook bot could be used to send messages to private streams that the user was not intended to be able to send messages to.
CVE-2021-30478
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the can_forge_sender permission (previously is_api_super_user) resulted in users with this permission being able to send messages appearing as if sent by a system bot, including to other organizations hosted by the sa...
CVE-2021-30479
PUBLISHED: 2021-04-15
An issue was discovered in Zulip Server before 3.4. A bug in the implementation of the all_public_streams API feature resulted in guest users being able to receive message traffic to public streams that should have been only accessible to members of the organization.
CVE-2021-30487
PUBLISHED: 2021-04-15
In the topic moving API in Zulip Server 3.x before 3.4, organization administrators were able to move messages to streams in other organizations hosted by the same Zulip installation.
CVE-2020-36288
PUBLISHED: 2021-04-15
The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting (XSS) vulnerability caused ...