tagged 
metrics, risk, security, vulnerability
metrics, risk, security, vulnerability Entries in metrics (6)
CIS Consensus Information Security Metrics - Converting Uncertainty into Risk
Sunday, January 31, 2010 at 3:19PM Full Disclosure
In my day job I am Solutions Architect for the McAfee Risk and Compliance Business Unit. Our products cover compliance management, risk management, IT security risk analysis, and a range of application and change control technologies.[3/2/2010 note: when I wrote this article I worked for McAfee. I do, however, no longer. :)]
In a former life I evaluated complex, multidimensional data sets using models and metrics - I was a scientist performing quantitative analysis of noisy data. The result is that I've spent many years and a lot of energy thinking about and using models, metrics, and measurement. That background gives me certain views, opinions, and expectations.
Now that you know where I'm coming from let's talk about risk, measurements, metrics, and uncertainty. ;)
Risk Is Better Than Uncertainty
Sunday, December 6, 2009 at 3:28PM The IT GRC field is in transition. Today we are dealing with UNCERTAINTY when we really, really want to be working with RISK because the management tools are so much better. However, there is a light at the end of the tunnel. The electronic medium that caused the situation should also help us solve the problem. We just need to keep collecting data, tracking the improvements produced through compliance, and creating new models and metrics.
tagged compliance, metrics, models, risk
compliance, metrics, models, risk Model? What Do You Mean?
Sunday, November 29, 2009 at 3:24PM We need to agree on what we mean when we use the word MODEL. Why? Because if we don't start at the base of our pyramid of understanding then we can each be going down different paths without ever knowing it. When we create IT Security risk metrics we need to be conscious of the models underpinning those metrics so that we can interpret them wisely.
Risk, Metrics, and Models
Saturday, November 28, 2009 at 2:17PM It is widely agreed that managing IT security risk requires security metrics. This seems to be where widespread agreement stops, however. If we are going to work through this phase of the maturing of IT security we must speak a common language derived from common conceptual frameworks.
Are Vulnerability Metrics and Risk Metrics Different?
Sunday, September 20, 2009 at 10:41AM The Common Vulnerability Scoring System (CVSS) was constructed as a Vulnerability Metric. However, there is no structural difference between CVSS and a generalized Risk Metric model. The types of information that go into both are the same and the behavior of CVSS is consistent with the model.
Risk? What Do You Mean?
Sunday, September 13, 2009 at 5:28PM The products that my employer develops are all about buzzwords like Vulnerability, Compliance, and Risk. You will find these words and phrases all over the computer security field along with others, like Buffer Overflow, Malware, PUPS (potentially unwanted programs, meaning, stuff you probably don't want but if someone called it Malware someone could get sued), Data Loss Prevention, Host Intrusion Prevention System, SPAM, and Antivirus. Most folks are only really aware of one, Antivirus, and may think it means all of the above. :)