This talk is meant to highlight some of the important things security professionals need to know, when creating security metrics.

1. Connect | Protect | Optimize
Lies
Fables
and Security Metrics

2. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
Biography
Vice President, Security Strategy
• 23 years in cyber security
• Expertise in program development, strategy,
measurement
• Podcaster: Down the Security Rabbithole Podcast
• Writer and public speaker

3. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
The Services Platform
Core
Remote
Virtual
Connect people,
business-critical
processes, and
assets to data and
customers
Protect what
matters to your
business, decrease
cyber risk and
meet compliance
requirements
Optimize your strategy
and operations to
continually evolve

4. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
Data Needs Meaning
Why your metrics presentations fail to deliver your point

5. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
cybersecurity is not absolute

6. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
there is always some risk

7. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
but…so what?

8. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
critical | high | medium | low

9. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
“arbitrary critical statistics”

10. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
consider the statement:

11. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
“we have 25mi range left”

12. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
what’s the rest of the story?

13. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
urgency without context

14. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
without context it’s arbitrary

15. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
examples of this…

16. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
200 new critical vulns
(a) (b) (c)

17. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
50% decrease in malware
(b)
(a)

18. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
without context – audience
makes up their own narrative

19. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
the lesson:

20. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
the board cares

21. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
you’re failing to communicate

22. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
you’re missing the
denominator

23. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
my 2 main types of metrics

24. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
trend (better/worse)

25. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
how is risk trending and why

26. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
impact (a -> b)

27. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
result of one or more actions

28. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
both are composite metrics

29. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
start with a goal

30. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
what do you want to show?

31. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
you may be missing data

32. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
don’t draw conclusions your
data doesn’t support

33. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
Storytelling
How to build impactful metrics that deliver the point

34. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
start with a goal

35. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
develop a narrative

36. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
pre-set the conclusion

37. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
be ready to be wrong

38. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
identify the denominator

39. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
pick the right tool
trend or impact metric

40. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
define your strategy

41. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
understand key influencers

42. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
identify data sources

43. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
collect data

44. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
rationalize narrative

45. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
is your narrative supported?

46. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
present your outcome

47. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
maintain your data set

48. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
refine your approach

50. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
Painting Masterpieces
Impactful metrics that deliver outcomes

51. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
tips to impactful metrics

52. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
reasonable

53. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
call to action

54. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
rational and explainable

55. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
repeatable

56. Complexity Averted. Possibilities Realized. © 2021 Lightstream Communications. All rights reserved.
stay away from BSNs

57. Complexity Averted.
Possibilities Realized.
www.lightstream.tech