Metrics That Actually Improve Security
Presenter:  Jennifer Bayuk
Originally Aired:  Tuesday, June 29, 2010, 1pm ET - 4pm ET
Price: $200
Register Now

ALREADY AN ELITE MEMBER or REGISTERED? - Click here to launch the video.

Measurement maps from observations to formal representations in a repeatable manner. Information Security is not easily observed, and formal representations are elusive. Attempts to measure information security have created a wide variety of metrics characterizations. This course will survey the security metrics methodologies available to today’s practitioner, and explore the pros and cons of each. 

Specific topics include: 

• Metrics type characterization and the utility of each in contributing information required to manage a security program. 
• How to understand the contextual value (if any) in metrics designed to show the efficacy of a security program.
• Data, tools, and techniques to demonstrate that metrics correspond to systems architecture.
• Remediation metrics and how they differ from risk management metrics.
•  How to determine whether metrics correspond to control points.
•  Mapping metrics to InfoSec program objectives.
• How to spot misleading metrics.
• Examples and exercises in metrics development.

References:  

• Bayuk, J.,Security Metrics, The Computer Security Journal, Vol XVII, No 1, a Computer Security Institute publication, January, 2001. 
• Jaquith, A, Security Metrics, RR Donnelly, 2007.  
• Herrmann, D, Complete Guide to Security and Privacy Metrics, Auerbach, 2007.
  

Register Now

ALREADY AN ELITE MEMBER or REGISTERED? - Click here to launch the video.

For more information, please email csi@ubm.com.