Developing useful metrics

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Lisa Young
Developing Useful Metrics
GRC-F03
Vice President, Service Delivery
Axio Global
Lyo...

#RSAC
Notices
Copyright 2016 Carnegie Mellon University
This material is based upon work funded and supported by the Depar...

#RSAC
GRC-F03
3
This session
does not cover specific technical security metrics
does cover the importance of metrics tied ...

#RSAC
Why do you want to measure?

#RSAC
Key questions
What should I measure to determine if I
am meeting my performance objectives for
security?
What is the...

#RSAC
Terminology (*)
Measure vs. metric
I had 2 eggs for breakfast this morning
It’s 53 degrees in San Francisco, CA
This...

#RSAC
So what? Why do you care?
If I had this metric: (*)
What decisions would it inform?
What actions would I take based ...

#RSAC
Why measure?
Speak to decision makers in their language
Demonstrate that the security program has
measurable busines...

#RSAC
Deriving Metrics from Objectives
- GQIM

#RSAC
Key questions
Not “What metrics should I use?” but
“What do I want to know or learn?”
Alternatives:
What decisions d...

#RSAC
Purpose
Use a defined, repeatable process to derive meaningful metrics that
directly support achievement of business...

#RSAC
Key takeaways
Understand a 5-step process for deriving metrics from business or
program objectives
Be able to apply ...

#RSAC
GQIM process
Objectives
Identify
business
objectives that
establish the
need for
resilience and
cybersecurity
Goal
D...

#RSAC
Objectives to Goals

#RSAC
Process
State a business or program objective
Define one or more goals that are required to achieve the stated
objec...

#RSAC
Objectives to Goals
What are meaningful actions to take to achieve the objective?
Which actions are most important?
...

#RSAC
Objective to Goals – Incident Management example
Objective Goal
Mitigate the risks of business
disruption and loss r...

#RSAC
Goals to Questions

#RSAC
Goals to Questions -1
What are meaningful questions to answer to determine if the goal is
being achieved?
Requires s...

#RSAC
Goals to Questions -2
Useful questions are in the form of:
What is the process for . . . (better than “How does the ...

#RSAC
Goal to Questions – IM example
Goal Questions
G1: Operate a cybersecurity
incident center that detects,
responds to,...

#RSAC
Questions to Indicators

#RSAC
Questions to Indicators
What data do I need to answer the question?
Can add more data granularity than called for in...

#RSAC
Goal Question Indicators
G1
Q1: What is the process by
which suspicious events are
detected and declared as
incident...

#RSAC
Indicators to Metrics

#RSAC
Indicators to Metrics
Using the indicator data, what number, percentage, mean, or other
metric can I collect/calcula...

#RSAC
Using this method to validate
your current questions or metrics

#RSAC
What if I only have a Metric? - 1
“We’ve always reported the number of machines with patches out of
date.”
How are y...

#RSAC
What if I only have a Metric? - 2
Answering this question will demonstrate substantive progress in
achieving what go...

#RSAC
Using GQIM to restate
Strategic Business Objective: Mitigate the risk of successful software exploits by
minimizing ...

#RSAC
What if all I have is a Question? - 1
“I’m always asked if my users have the proper level of system access.”
How are...

#RSAC
What if all I have is a Question? - 2
What is the strategic business objective tied to this goal?
Strategic business...

#RSAC
Using GQIM to Restate
Strategic Business Objective: Mitigate insider threats by ensuring appropriate levels of
syste...

#RSAC
Barriers and challenges
What current barriers do you face in establishing, managing, and/or
executing a measurement ...

#RSAC
Getting started

#RSAC
Approach
State a business objective
Ideally your business objective supports a stated strategic objective
Ensure tha...

#RSAC
To get started
Identify sponsors and key stakeholders
Define security objectives and key questions
Determine informa...

#RSAC
Questions
Lisa Young
Email: Lyoung@axio.com
Vice President, Service Delivery
Axio Global
David Tobar
Email: DTobar@c...

#RSAC
CERT | Software Engineering Institute | Carnegie Mellon
Software Engineering Institute (SEI)
Federally funded resear...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 39 Ad

View on Slideshare

1 of 39 Ad