Disclaimer: The opinions of the columnists are their own and not necessarily those of their employer.

Tag Archives: metrics

The Status of Recent Research Concerning Data Breaches and Reputational Risk

September 11, 2008 – 6:00 am – Nearly three years ago, Ken Belva wrote a paper intended to be a “starting point for further, positive discussion” regarding the topic of data breaches and reputational risk.  The title of the paper also presented Ken’s major theme:  “How It’s Difficult to Ruin a…
By | Posted in General | Also tagged , , , | Comments (0)

Crossing the Metrics Rubicon: Quest for the Perfect Measurement

July 18, 2008 – 6:00 am – Security metrics represent a great untamed wilderness for organizations trying to determine both their risk profile and the effectiveness of the resources they have allocated to their security program. When I first became a security person after a career managing customer service, finance, and…
By | Posted in Technical | Also tagged , , | Comments (0)

Provisioning: Security’s First Step to Measuring Organizational Impact

July 8, 2008 – 6:00 am – Security is often accused, occasionally with merit, of being an obstacle to an organization’s business. While the drumbeat of cyber threats has at least raised the technology risk consciousness of many business managers, security professionals still have the challenge of quantifying how big an…
By | Posted in Technical | Also tagged , , | Comments (0)

The OCC and Application Security: Vindication at Last

June 17, 2008 – 6:00 am – On May 8, 2008, the OCC (Office of the Comptroller of the Currency, part of the U.S. Department of the Treasury) issued Bulletin 2008-16, which you can find here. As the OCC states, there have been prior mentions of application security by the FFIEC (of which OCC is a member), NIST and others.…
By | Posted in CSO/CISO Perspectives | Also tagged , , , , , , | Comments (0)

Metrics Revisited – Application Security Metrics

May 12, 2008 – 6:00 am – I have recently been giving some thought to, and doing some research into, application security metrics, and I have determined, quite simply, that there aren’t any good ones. “How ridiculous!” you say, “We have two dozen application security metrics, which we report in…
By | Posted in Risk Analysis, Security Metrics | Also tagged , , , | Comments (0)