Metrics: Practical ways to measure security success

This presentation by Pete Lindstrom, Research Director for Spire Security, was given at Information Security Decisions Spring 2005.

Today, security is more of an art form than scientific endeavor. We are stuck with perceptions

    Requires Free Membership to View

of "good security" and "bad security" that revolve around possibility and paranoia rather than in-depth analysis. Meanwhile, security professionals need to operate as a business unit within an organization and produce "results" -- whatever they may mean.

Rather than trying to measure security in the abstract, Pete Lindstrom, Research Director for Spire Security, argues that security managers should first align security with business goals, and then measure progress toward those goals. In this presentation, Lindstrom discusses the practical approaches to meaningful security metrics, and shows how security managers can demonstrate risk reduction efficiency -- and effectiveness -- through goal-oriented metrics. You discover:

  • A framework for security metrics that you can employ right away
  • Insight into the types of metrics available to a variety of security practitioners
  • Practical ways to introduce metrics into your own organization

View the presentation

Visit the metrics and measurement resource center

This was first published in May 2005

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.