Metrics are all the rage, and it makes sense: they provide a way to objectively measure things like performance – and security. The problem is how to go beyond the use of metrics as an informational tool to see what did happen and use them to predict what will happen, in order to take preventative measures against attacks.
To justify the cost of those preventative measures, though, you need the buy-in of management, and that’s where things get sticky. According to this article from SecurityWeek, “The challenge for many security professionals is translating the scope, scale, and effectiveness of security initiatives into terms that can be understood by executives and boards.”
Read more about this challenge and how to deal with it, here:
http://www.securityweek.com/why-business-has-problem-security-metrics
