How to gather, analyze, and present security metrics for operational improvement and budgeting. Numbers are the language of business. Fortunately, security metrics are growing ever more sophisticated. Knowing what to measure, how to measure it and how to communicate those metrics can help improve security’s efficiency, effectiveness and standing in the business world. These in-depth CSOonline and CSO Magazine articles will help you get up to speed on state-of-the-art security metrics.Last update: 11/12/2012The basics: Choosing and using security metricsHow to Use Metrics Security leaders generate data every day. Knowing what to look for and how to analyze it can spell success for a security operation and the organization it serves.Presenting metrics: Answering the ‘so what’ question Presenting metrics to business execs? Be sure to express outcomes in the terms your audience cares about.Risk measurement, assessment, and management7 common risk management mistakes!Faulty statistical methods and other common errors that can trip up your program.What’s your Total Cost of Risk (TCOR)?Insurance buyers have been calculating “total cost of risk” for decades. Now the equation is expanding to better cover operational risk. The great IT security risk measurement debate, part 1 Alex Hutton (Verizon Business) and Douglas Hubbard (author of The Failure of Risk Management) discuss whether IT security risk can be accurately measured and how to improve risk management.IT risk assessment frameworks: an introductionOCTAVE, FAIR, NIST RMF, and TARAMetrics and strategyBuilding out your strategic security metric framework Pete Lindstrom says follow Willie Sutton’s advice and go where the money is.Information security, value creation and the balanced scorecardJamil Farshchi and Ahmad Douglas of LANL spell out a management framework that ties information security strategy to the organization’s mission.Financial metricsSecurity and Business: Financial BasicsYou need to find and use the right financial metrics to communicate security’s value to your company. Here are pros and cons of four common methodologies: TCO, ROI, EVA and ALE.Return on Security InvestmentAnd a partially contrarian analysis of ROI from Bruce Schneier:Security ROI: Fact or Fiction?Sure, determining ROSI (return on security investment) is difficult. But it’s also the key to selling your budget. Here’s our three-step guide to getting started.Bruce Schneier says ROI is a big deal in business, but it’s a misnomer in security. Make sure your financial calculations are based on good data and sound methodologies.Value Made VisibleAt American Water, Bruce Larson uses a simple ‘value protection’ formula to help prioritize spending.Operational metrics10 identity management metrics that matterGood metrics help identify inefficiencies and security holes in your identity management processes. Are you tracking these ten key measures?A Few Good Information Security MetricsAndrew Jaquith says information security metrics don’t have to rely on heavy-duty math to be effective, but they also don’t have to be dumbed down to red, yellow, green. Here are five smart measurements–and effective ways to present them.Using Metrics to Diagnose Security Problems: A Case Studyand companion pieceSample Diagnostic Questions for Finding Information Security WeaknessesAndrew Jaquith is a Yankee Group analyst and founder of discussion site Securitymetrics.org. The following excerpt is taken from his book Security Metrics: Replacing Fear, Uncertainty, and Doubt.Metrics for Corporate and Physical Security ProgramsInvestigations, supply chain, compliance, theft and restitution and more – CSOs count on physical security metrics to evaluate their organizations’ performance and to communicate security’s value to other business executives.Physical Security Risk and Countermeasures: Effectiveness MetricsAuthor Thomas Norman lists ways to measure and improve your security programIdeas You Can Steal from Six SigmaTips from the rigorous quality methodology for improving the effectiveness and efficiency of physical and information security.More about metrics priorities and presentationThe Metrics QuestUnder pressure from the CFO to quantify security benefits, a CSO finds real-world measures that matter.Steel PistonsSeven quick-and-dirty tricks for using numbers to strengthen your case.Survey data and benchmarksThe security research and data directoryNeed numbers? We’ve gathered a long list of security surveys with links to results and analysis from across the industry. Covers a broad range of subjects from data protection and network security through physical security, business continuity and fraud prevention. Need security data? Find it here.Global State of Information SecurityData and analysis from the annual worldwide survey conducted by CSO, CIO and PricewaterhouseCoopers.2012 results and analysis: Are you a security leader—really?2011 results and analysis: Business partners, cloud security, and more2010 results and analysis: Social networking peril2008 results2007 results2006 results2005 results2004 resultsState of the CSO2011 results and analysisThe rise of risk management [PDF – free Insider registration required]2010 results and analysis Progress and peril 2009 results Influence grows; will it last?2008 results Powering up!Our exclusive survey on risk management and security. Data on CSO responsibilities, maturity of organizational security policies, and more.What do you need to measure? What metrics should CSO explore next? Email Editor Derek Slater at dslater@cxo.com Related content news Google Chrome zero-day jumps onto CISA's known vulnerability list A serious security flaw in Google Chrome, which was discovered under active exploitation in the wild, is a new addition to the Cybersecurity and Infrastructure Agency’s Known Exploited vulnerabilities catalog. By Jon Gold Oct 03, 2023 3 mins Zero-day vulnerability brandpost The advantages and risks of large language models in the cloud Understanding the pros and cons of LLMs in the cloud is a step closer to optimized efficiency—but be mindful of security concerns along the way. By Daniel Prizmant, Senior Principal Researcher at Palo Alto Networks Oct 03, 2023 5 mins Cloud Security news Arm patches bugs in Mali GPUs that affect Android phones and Chromebooks The vulnerability with active exploitations allows local non-privileged users to access freed-up memory for staging new attacks. By Shweta Sharma Oct 03, 2023 3 mins Android Security Vulnerabilities news UK businesses face tightening cybersecurity budgets as incidents spike More than a quarter of UK organisations think their cybersecurity budget is inadequate to protect them from growing threats. By Michael Hill Oct 03, 2023 3 mins CSO and CISO Risk Management Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe