Re: Security Metrics

hi, john.

don't know of any papers that recorded the details of an actual security 
assessment for a company, but check out Pete Herzog's OSSTMM project 
(http://www.isecom.org/osstmm/) for an assessment guideline. 

As for the tools, Pete used to have a list of tools related to each security 
test method at OSSTMM's old home, www.ideahamster.org, but you can get a list 
of the commonly used security testing tools at 
"http://www.hackingexposed.com/tools/tools.html"; or at 
"http://www.insecure.org/tools.html";.

HTH

dan

----- Original Message -----
From: "John Blackley" <jblackley@sysmatrix.net>
To: security-management@securityfocus.com
Subject: Security Metrics
Date: 14 Apr 2005 15:24:18 -0000

> Folks,
>
> a little guidance here please. I'm looking for work already done on 
> building security metrics for an organization. Let's say an 
> organization wants to measure its security performance against a 
> baseline (perhaps ISO17799?). Do you know of any works that have 
> been published showing how it was done or tools that were used in 
> the effort.
>
> Any help will be appreciated.
>
> John A Blackley