5 Tips on How to Build a Strong Security Metrics Framework

5 Tips on How to Build a Strong Security Metrics Framework
The carpentry maxim "measure twice, cut once" underscores the importance of timely, accurate, and regular metrics to inform security leaders' risk decisions.

When designed appropriately and measured objectively, metrics are an indispensable part of a mature security program. Solid metrics can help an organization measure and track risk and performance as well as make educated adjustments and decisions as required. While most security professionals recognize and understand this, in practice, only a few organizations actually realize significant benefits from security metrics. There are many approaches to building an effective security metrics program. In this piece, I'd like to share some thoughts on a framework that has worked well for me.


Tip 1: Know your audience. Years ago, when I took a presentation seminar, I was given some very good advice: Know your audience. This advice applies to many areas, including metrics. The first step toward building a strong metrics framework is to understand who you're building it for, even if there are multiple audiences. The metrics reported to the board and executives will be different than those you use to make operational improvements and tactical adjustments. The metrics provided to customers showing that their data is protected will be different than the metrics for security management to make well-informed decisions. A good metrics framework provides the right metrics to the appropriate audiences, even when there are multiple audiences.


Tip 2: Aggregate: One great way to provide the right metrics to the appropriate audiences is to aggregate strategically. Each tier is more detailed than the tier above it, and more granular metrics roll up into broader, more strategic metrics as you move up through the tiers. As an example, consider four tiers of aggregation that I have found helpful in building out a sound security metrics framework:
Support the originator by clicking the read the rest link below.