Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


09:00 AM
Connect Directly

New Metrics Assign Grades to Your Security Posture

Free, user-driven metrics a step toward making security measurement more of 'a science instead of a black art'

A coalition of enterprises, government agencies, universities, and vendors from around the globe tomorrow will release a set of free metrics for measuring an organization’s security posture.

The nonprofit Center for Internet Security (CIS) hopes the metrics will serve as a standard method for assessing security readiness. “Today there are thousands of ways to measure this… but no two organizations measure these things the same way, and no two divisions [in the same organization] measure them in the same way,” says Bert Miuccio, CEO of CIS. “Today we are creating an objective, data-driven way to measure the security status of an enterprise.”

Miuccio says this “number grade” can be used to help a company make more informed security buying decisions or change its security strategy, for instance. “This lets decision-makers understand the security status of their organization over time,” he says.

CIS consists of more than 150 member companies, including Fidelity National Financial, General Dynamics, Lockheed Martin TSS, Mortgage Guaranty Insurance Group, Royal Bank of Canada Capital Markets, Southwest Airlines, Union Bank of California, and the Federal Reserve Board and U.S. Dept of Homeland Security ‘s Computer Emergency Readiness Team (US-CERT)

Security experts say only time will tell whether CIS’s security metrics will take off. But even if it only gets the conversation going, that is progress, since there hasn’t before been an effective, standard way to test and measure security postures, they say.

“It’s at least the basis for the next try,” says Fred Pinkett, vice president of product management for Core Security. “There has come a time in security where we need to be looking at this more scientifically than the technical people in the back room saying ‘Listen to us’ and ‘Go about your business.’ We need the business to understand what we’re doing.”

Companies need a way to determine why their security policies and procedures may not be working. “They put all of these policy and procedures in, but they may still be getting attacked and they want to know what’s going on,” Pinkett says. “Measuring and testing yourself” is a good way to start truly understanding what’s working and what’s not, he notes.

The first set of metrics that the CIS will release tomorrow for download are: mean time between security incidents; mean time to recover from security incidents; percentage of systems configured to approved standards; percentage of systems patched to policy; percentage of systems with anti-virus; percentage of business applications that had a risk assessment; percentage of business applications that had a penetration or vulnerability assessment; and percentage of application code that had a security assessment, threat model analysis, or code review prior to production deployment.

Miuccio says the metrics define what to measure and how, and then let an organization look at the trends over time. They also allow an organization to compare its scores with other organizations in its vertical market to see where it stands compared to others in the same industry, he says.

Ensuring a meaningful comparison among organizations’ security postures won’t be easy, experts say. “It’s always great to have data. It’s interesting to see what constraints they put around the data so they get an apples-to-apples comparison,” says Dick Mackey, vice president of consulting for SystemExperts.

Meanwhile, CIS will also launch a software-based security metrics service for its members that helps them correlate their security practices with their number grades, as well as anonymously compare their grades to other organizations in their field.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Core Security Technologies
  • SystemExperts Corp.

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Recommended Reading:

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    COVID-19: Latest Security News & Commentary
    Dark Reading Staff 7/2/2020
    Ripple20 Threatens Increasingly Connected Medical Devices
    Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
    DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
    Dark Reading Staff 6/30/2020
    Register for Dark Reading Newsletters
    White Papers
    Current Issue
    How Cybersecurity Incident Response Programs Work (and Why Some Don't)
    This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
    Flash Poll
    The Threat from the Internetand What Your Organization Can Do About It
    The Threat from the Internetand What Your Organization Can Do About It
    This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    PUBLISHED: 2020-07-02
    Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
    PUBLISHED: 2020-07-02
    A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
    PUBLISHED: 2020-07-02
    In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
    PUBLISHED: 2020-07-02
    In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
    PUBLISHED: 2020-07-02
    In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.