Itemizing costs and justifying efforts is a problem all IT departments have. Being able to assess costs, gauge time and resource requirements, and determine gaps is important in communicating project status with upper management. To address this community issue, Project Quant for Database Security was started. This is an open, community-driven, vendor-neutral effort with the models for database security free to the public.
The first step was to analyze how businesses go about securing their databases. We quickly discovered this is not a single process, but one that comprises of a dozen or more efforts. Worse, there really is no formal patch management, vulnerability assessment, or configurations management process for databases. With the goal to provide tangible metrics, we need to examine each of these efforts individually, breaking them into discrete tasks small enough to accurately assign quantitative metrics.
Building out individual processes for assessment, monitoring, auditing, and patching provided the granularity necessary. It allowed individual organization to mix and match processes, tailoring to their respective complexity, and assign time and resources that reflected their needs.
As with most open efforts, the more database and security professionals who participate, the better the results. And the more participating people and organizations, the better we can reflect DBA and IT efforts. Project Quant for database security is still under way, with the entire effort open to comments and critique. If you are interested in contributing to this effort, then you are invited to participate.
Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading.