Лучшие метрики по информационной безопасности

Лучшие метрики по информационной безопасности
В отчете " The State of Risk-Based Security 2013 " нашел интересную информацию: метрики, которые чаще всего используют специалисты по ИБ в USA и UK (рассортированы по частоте использования). Вот они:
  1. Reduction in the cost of security management activities
  2. Length of time to implement security patches
  3. Spending level relative to total budget
  4. Percentage of endpoints free of malware and viruses
  5. Number of end users receiving appropriate training
  6. Reduction in unplanned system downtime
  7. Reduction in number of access and authentication violations
  8. Reduction in the total cost of ownership (TCO)
  9. Return on security technology investments (ROI)
  10. Reduction in number of known vulnerabilities
  11. Reduction in number of data breach incidents
  12. Reduction in number of percentage of policy violations
  13. Reduction in audit findings and repeat findings
  14. Number of security personnel achieving certification
  15. Number of records or files detected as compliance infractions
  16. Percentage of software applications tested
  17. Reduction in the frequency of denial of service attacks
  18. Reduction in regulatory actions and lawsuits
  19. Reduction in expired certificates (including SSL and SSH keys)
  20. Mean time to detect security incidents
  21. Reduction in the number of threats
  22. Reduction in the cost of cyber crime remediation
  23. Percentage of recurring incidents
  24. Percentage of incidents detected by automated control
  25. Performance of users on security training retention tests
  26. Time to contain data breaches and security exploits
  27. Reduction in the number or percentage of end user enforcement actions
  28. Reduction in loss of data-bearing devices (laptops, tablets, smartphones)
Ну, а вообще, лучше метрик для измерения ИБ может быть только оценка зрелости процессов ...
Alt text
Комментарии для сайта Cackle

Andrey Prozorov

Информационная безопасность в России и мире