In Depth

How to Use Metrics

CSOs generate security data every day. Knowing what to look for and how to analyze it can spell success for a security operation and the organization it serves.

By George K. Campbell

4. Good metrics are SMART

Good metrics are "SMART"specific, measurable, attainable, relevant and timely. (That idea originates with the engineering text Winning With Quality: Applying Quality Principles in Product Development, by John Wesner et al.) It's a CSO's job to find the appropriate model for security measurement and reporting objectives that fits his organization. The most important data to the security executive depends on what is most important to his senior management and other stakeholders. It depends on what factors your supervisor will use to rate your performance. It depends on what you use to effectively measure the performance of your people and key vendors. It depends on what you need in your unique security environment to most effectively communicate, manage and influence.

Influence is often data-dependent. If you have a good grounding in the business and have the right radar working, you likely know things about risk, the value equation, the competition and the business risk environment that is not available or obvious from other sources.

• Email
• Print
• Comments
• Digg This
• SlashDot

• A Few Good Information Security Metrics
• New Security Leadership: The Basics
• Calculated Risk: Return on Security Investment