Metrics for Operational Security Control

This paper aims to inform the reader on what metrics are, why metrics can be an important tool for controlling security systems; and, how metrics fit into the day to day IT operations to improve security by measuring, reporting and tracking key elements of systems that have an impact on security. The paper will include examples of systems for which metrics can be collected, what metrics can be collected for each system and how the metrics can be presented to provide control information on the system being examined. The paper will also explore options to 'build or buy' as well as list organizations that promote the use of metrics as a tool and organizations that have specialized experience using metrics for security.