3 Implementing a security metrics program

 

This chapter covers

  • Designing a cybersecurity metrics program
  • Building effective metrics dashboards
  • Open source tools
  • Analyzing and reporting to inform actionable decisions
  • Common challenges and pitfalls and how to avoid them

Implementing an information security program is more than simply setting up defenses, checking boxes, and assuming everything is done. Organizations must continuously evaluate the effectiveness of security measures. Having data-driven insights and the ability to measure and analyze that data is the best way to make better, more informed decisions. The metrics discussed throughout this book will allow you to measure the performance of your information security program. In addition, it can help you identify weaknesses, optimize your defenses, and report to the C-level on your standing.

Chapter 3 discusses the importance of a well-designed cybersecurity metrics program. Here, I provide a repeatable and proven process using the METRICS (Measure, Evaluate, Threshold, Report, Improve, Communicate, and Sustain) methodology—a comprehensive guide for measuring and evaluating security performance to better align our efforts with business goals. This chapter presents the framework for building a sustainable and scalable metrics program.

3.1 Introducing metrics program design

3.1.1 Key components of a security metrics program

3.2 METRICS methodology

3.2.1 Measure

3.2.2 Evaluate

3.2.3 Threshold

3.2.4 Report

3.2.5 Improve

3.2.6 Communicate

3.2.7 Sustain

3.3 Using the METRICS methodology example

3.3.1 Step 1: Measure

3.3.2 Step 2: Evaluate

3.3.3 Step 3: Threshold setup

3.3.4 Step 4: Report

3.3.5 Step 5: Improve

3.3.6 Step 6: Communicate

3.3.7 Step 7: Sustain

3.3.8 Exercise summary

Summary