In his thought-provoking presentation, Dr. Mike Lloyd - Chief Technology Officer at RedSeal Networks - described methods for building an enterprise security metrics program that’s completely different from the current model of counting vulnerabilities or numbers of patches applied.
He outlined methods for monitoring the threat landscape, and your organization’s exposure, as well as offering some best practices for measuring the effectiveness of current security tools and systems. Best of all, he outlined a way to build a maturity model for security, so that you can show your security team’s performance on a month-to-month basis, and demonstrate its continuing improvement over time.
How does your organization measure and report its security posture and performance? Do you have spreadsheets that show how many vulnerabilities you found last month, or how many viruses your AV system stopped?
Those numbers might pacify your management, but any security pro can tell you that they are no way to benchmark the real work you do – or how much danger your enterprise might be in.
Maybe the problem is that we’re all trying to use the data we already have – host metrics, network metrics, applications data – instead of building the data we actually need.
Dr. Lloyd believes we need metrics that show the current range of threats, and the enterprise’s exposure. We need data that shows whether our security tools and programs are actually working or not. We need methods for demonstrating that our security teams are performing well – not only this month, but over a period of time.