Application Security

12/21/2018
04:15 PM
50%
50%

7 Business Metrics Security Pros Need to Know

These days, security has to speak the language of business. These KPIs will get you started.
Previous
1 of 8
Next

(Image: Moritz320)

Peter Drucker, aka the founder of modern management, is credited with writing, "If you can't measure it, you can't improve it." Over time, that has been broadened to, "If you can't measure it, you can't manage it," a statement that is taken as holy writ for most modern executives.

Indeed, business in the 21st century is all about metrics. Cybersecurity has plenty, measuring everything from port probes to login attempts. It's expected that cybersecurity managers will have a good handle on all of these metrics and know what they're saying about their organizations. But in today's business organization, these security metrics aren't enough.

In order to protect the business, security has to speak the language of business. The last decade has seen a growing, if sometimes grudging, acknowledgment of this by security professionals. The question for many security pros is, "Which business metrics should I know?"

Each organization may have its own unique key performance indicators (KPIs) to take into consideration. But certain metrics matter regardless of the particular business. To cover all of them is the subject of an MBA, but we've put together a list that includes some basics, some that might escape first notice, and some that have a particular interest from a security perspective.

In each case, these are metrics that cybersecurity pros should understand and pay attention to. Do you use them in your security practice? What other metrics do you think should be on this list? Let us know in the comments.  

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ThomasMaloney
50%
50%
ThomasMaloney,
User Rank: Apprentice
1/16/2019 | 4:11:30 AM
Always improving ourselves
We do not become an expert overnight and even when we have reached a certain standard, there is always room for improvement. There are always guidelines or metrics that we can fall back on even if we have reached an expert level. We should always allow ourselves to have room for improvement in order for us to remain relevant in the sector and know any progressive updates.
mark@polaris
50%
50%
[email protected],
User Rank: Apprentice
1/15/2019 | 9:59:29 PM
Re: Productivity/accessibility as security considerations (or not)
Interesting feedback from others reading the article. Here's my take:

Productivity should be measured as there is a lot that can be learned IF they are done correctly. Hours worked is another interesting metric but is not something that should be measured daily or weekly, at least in my opinion. This would start to drive the wrong behaviors on the floor. As for the Net Promoter Score, I don't think that I've ever really agreed with the metric at least from any process that can game it (and most that I've seen, can.) I just don't think that it's very useful in a cyber security setting. I agree with the Lead to Client conversion rate but think that a cyber security operation should focus more on cycle time and quality of hand off to them if they are concerned about inbound work. By looking at these two areas a tremendous amount can be learned and improved on. Personally, I think that cyber security has a very long way to go when it comes to metrics and improvement. The legitimate need to focus primarily on technology means that people and process are not focused on as much as they should be.
EdwardThirlwall
50%
50%
EdwardThirlwall,
User Rank: Apprentice
1/3/2019 | 9:39:01 AM
Re: Productivity/accessibility as security considerations (or not)
I think that a lot of businesses forget about customer retention a lot. Because I run a business that builds its whole premise around making sure that a customer sticks with you once they've signed on, I think I'm a little qualified to make the comparison. It's not just about giving them a good price for the goods they've placed in storage with you but making sure your services are up to par so they don't want to move away from your company!
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
12/31/2018 | 10:37:35 PM
Productivity/accessibility as security considerations (or not)
The operating productivity (a.k.a. accessibility) metric is a tough and debatable one. On the one hand, security and accessibility are polar opposites of each other -- and, as such, it can be fair to assign security to the security teams and accessibility to the operations/business teams...and then let the C-suite make the appropriate decisions from there (in other words, letting both sides fully advocate/fight it out, and let the appropriate decision-makers earn their decision-making paychecks). OTOH, security professionals fully have to account for the possibility that overly burdensome/draconian security policies may perversely incentivize bad security in the long run.

I'd be interested to see what other readers think on this.
ashwinK123
50%
50%
ashwinK123,
User Rank: Apprentice
12/24/2018 | 3:15:38 AM
ashwin
Thank you to this post!
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Now, we come here to play Paw-ke Man Go!"
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6497
PUBLISHED: 2019-01-20
Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter.
CVE-2018-18908
PUBLISHED: 2019-01-20
The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle (MiTM) attacks, whereby an attacker would be able to obtain the data sent in these requests. Some of the requ...
CVE-2019-6496
PUBLISHED: 2019-01-20
The ThreadX-based firmware on Marvell Avastar Wi-Fi devices allows remote attackers to execute arbitrary code or cause a denial of service (block pool overflow) via malformed Wi-Fi packets during identification of available Wi-Fi networks. Exploitation of the Wi-Fi device can lead to exploitation of...
CVE-2019-3773
PUBLISHED: 2019-01-18
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVE-2019-3774
PUBLISHED: 2019-01-18
Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.