William Jackson | Some possible help for the tricky job of quantifying IT security
Connecting state and local government leaders
Measuring security is a difficult job that can put CSOs and CISOs at a disadvantage at budget time. A set of information security metrics has been developed by the Center for Internet Security to help provide a standardized, repeatable way to measure your security status.
Measuring IT security is difficult: If you do the job right, nothing happens. So how do you measure the value of something that doesn’t happen? This means that without a concrete loss of dollars and cents to point to, chief security officers and chief information security officers can be at a disadvantage at budget times. This is one of the reasons why so much of security is reactive rather than proactive.
The nonprofit Center for Internet Security has released a set of 20 consensus metrics for information security that can help to measure aspects of an enterprise’s information security status in standardized, repeatable ways. The idea is that these can be used within an organization to repeatedly evaluate security, recognize trends and understand the impact of activities and respond to improve the situation. This could help demonstrate the value of security activities before a breach occurs to get management’s attention.
CIS describes the metrics as “unambiguous definitions for security professionals to measure some of the most important aspects of the information security status. They are available for free download. If adopted widely, they also could be used for benchmarking security between organizations.
The metrics were decided upon by a group of more than 120 security experts from the commercial, government and academic worlds. Federal members of the CIS include the Centers for Medicare and Medicaid Services, the Federal Aviation Administration, the Federal Reserve Board, the Library of Congress, NASA, the National Institutes of Standards and Technology, the National Institutes of Health, the Census Bureau, the U.S. Patent and Trademark Office, and the Energy and Interior departments.
The metrics address basic questions about the outcomes of activities in six business functions:
- Incident Management: How well do we detect, accurately identify, handle and recover from security incidents?
- Vulnerability Management: How well do we manage the exposure of the organization to vulnerabilities by identifying and mitigating known vulnerabilities?
- Patch Management: How well are we able to maintain the patch state of our systems?
- Application Security: Can we rely on the security model of business applications to operate as intended?
- Configuration Management: How do changes to system configurations affect the security of the organization?
- Financial Metrics: What is the level and purpose of spending on information security?
CIS expects to add metrics for other areas, including data and information, software development life cycle, third-party risk management, anti-malware controls, and authentication and authorization. The goal is to have reporting capabilities for these metrics built into security products to enable and encourage widespread use.
I do not know enough about security management to know whether the metrics provided in this list will be as useful and informative as intended. But the idea of a standardized way to measure security is a powerful one and these seem to make sense. Metrics for measuring incident management, for instance, are: Mean-time to incident discovery, number of incidents, mean-time between security incidents and mean-time to incident recovery.
It can be argued that such a list by itself does not ensure or improve security and that answering the questions is a mere paperwork exercise that distracts administrators from the job of securing their systems against known threats. The same argument is made against the Federal Information Security Management Act. But the value of tools such as these lies in how they are used. Knowledge is power, and knowing your security status in a meaningful way is an essential step toward maintaining and improving it.
NEXT STORY: A new strategy for applying Oracle patches