Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/10/2020
10:00 AM
Joshua Goldfarb
Joshua Goldfarb
Commentary
Connect Directly
Twitter
RSS
E-Mail vvv
50%
50%

5 Tips on How to Build a Strong Security Metrics Framework

The carpentry maxim "measure twice, cut once" underscores the importance of timely, accurate, and regular metrics to inform security leaders' risk decisions.

When designed appropriately and measured objectively, metrics are an indispensable part of a mature security program. Solid metrics can help an organization measure and track risk and performance as well as make educated adjustments and decisions as required. While most security professionals recognize and understand this, in practice, only a few organizations actually realize significant benefits from security metrics. There are many approaches to building an effective security metrics program. In this piece, I'd like to share some thoughts on a framework that has worked well for me.

Tip 1: Know your audience. Years ago, when I took a presentation seminar, I was given some very good advice: Know your audience. This advice applies to many areas, including metrics. The first step toward building a strong metrics framework is to understand who you're building it for, even if there are multiple audiences. The metrics reported to the board and executives will be different than those you use to make operational improvements and tactical adjustments. The metrics provided to customers showing that their data is protected will be different than the metrics for security management to make well-informed decisions. A good metrics framework provides the right metrics to the appropriate audiences, even when there are multiple audiences.

Tip 2: Aggregate: One great way to provide the right metrics to the appropriate audiences is to aggregate strategically. Each tier is more detailed than the tier above it, and more granular metrics roll up into broader, more strategic metrics as you move up through the tiers. As an example, consider four tiers of aggregation that I have found helpful in building out a sound security metrics framework:

œ Group: The highest-level aggregate is the group. Each group should be a broad area within security made up of different functional areas. Some examples of groups might include "Compliance," "Vulnerability Management," and "Security Monitoring," among others.

œ Area: The next-level aggregate is the area. Each area should be a specific function within security that contains one or more risks that need to be measured. Areas might be "Application Risk Assessment," "Vendor Risk Assessment," and "Training and Awareness," among others.

œ Key risk: The next level aggregate is the key risk. Each key risk should represent an area of concern and focus for the business where security is expected to measure, monitor, manage, and mitigate that specific risk. Each key risk should measure whether or not the organization has incurred an unacceptable risk. Within each key risk are one or more metrics that can help shine light onto whether or not controls are effective.

œ Metric: The metric level is the lowest level — and, in fact, isn't really an aggregate at all. Metrics should be as granular, scientific, and objective as possible, while allowing the security team to measure specific risks. Each metric should be mapped to a control and should help to measure whether or not the control is mitigating risk appropriately.

Tip 3: Map to controls. Ultimately, a good metric will help assess whether or not a control is effective at reducing risk. This has many benefits, including allowing the security organization to gain an understanding of where gaps may exist or where controls may need to be either designed or implemented differently. Of course, these benefits are only attainable when metrics are mapped to controls. It is a bit of a time investment to do so, though it is well worth it.

Tip 4: Designate acceptable values and objective ranges. If you've ever had your home or car inspected, you know that there are acceptable levels for radon in a home or emissions from a car. It isn't black or white or on or off. There is a range of levels within which the home or car passes the test, and outside of which, it fails. The same should be true for metrics. Once you have a solid set of metrics, define acceptable values for those metrics together with ranges that define different levels of risk (for example, low/medium/high, green/amber/red, or any other set of groupings that suits your organization). That will allow you to more objectively calculate risk levels for each metric, different aggregates of metrics, and in total across the organization.

Tip 5: Measure and report regularly. The carpentry proverb, "measure twice, cut once" can help us understand the importance of timely, accurate, and regular metrics. Metrics should be living and dynamic, rather than snapshotted and static. Just as accurate measurements inform the carpenter's cutting decisions, accurate security metrics inform the security leader's risk decisions. It's important to remember that the value of a given metric represents an accurate measurement only in the moment it is measured. Because of this, it's important to measure frequently and report metrics regularly. This allows the security organization to trend over time, spot abnormalities early on, and prevent additional risk from entering the organization unnecessarily.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "In App Development, Does No-Code Mean No Security?"

Josh (Twitter: @ananalytical) is an experienced information security leader who works with enterprises to mature and improve their enterprise security programs.  Previously, Josh served as VP, CTO - Emerging Technologies at FireEye and as Chief Security Officer for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Google Lets iPhone Users Turn Device into Security Key
Kelly Sheridan, Staff Editor, Dark Reading,  1/15/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-16270
PUBLISHED: 2020-01-22
Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to dump Bluetooth HCI packets to an arbitrary file path.
CVE-2018-16271
PUBLISHED: 2020-01-22
The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox, due to improper D-Bus security policy configurations. An arbitrary email can also be sent from the mailbox via the paired smartphone. This a...
CVE-2018-16272
PUBLISHED: 2020-01-22
The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-Bus security policy configurations. This affects Tizen-based firmwares including Samsung Galaxy Gear series before build RE2.
CVE-2019-10780
PUBLISHED: 2020-01-22
BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.
CVE-2019-10781
PUBLISHED: 2020-01-22
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.