Re: Security Dashboard

At 02:50 PM 24/02/2006, Fred Cohen wrote:


> But in what sense does this help actually answer any important or
> useful questions? Say I measure it and I find that the patch cycle
> time for a computer is 5 days and the number of unpatched machines is
> 20% of all machines. What value does this have for me. Should it be
> more? less? at what cost?

Fred has a point - I had a dashboard - or more accurately I was 
putting something on my CIO's dashboard indicating the status of his 
Audit issues. It worked because
1. We already had a management dashboard that was regularly used
2. I was already managing the data in a database
3. it is easy to generate a "traffic light" on audit issues:
red = issues missed commit date, don't have commit date or don't have owner
Yellow - you have issues, but they are managed
green no issues open

When it comes to things at the infrastructure level though - the 
first thing you need to get right is the process and the thresholds - 
else a dashboard just becomes the cool techo tool to what is really a 
people problem

Cheers,

Bret