RE: Key Performance Indicators Information Security

www.securitymetrics.org is a great resource for this topic. Andy Jaquith is
writing a book on the subjhect and has some very inciteful comments in his
draft chapters that are online. 

-----Original Message-----
From: Dennis Opacki [mailto:dopacki@adotout.com] 
Sent: Tuesday, June 06, 2006 9:23 PM
To: Salaets, Steven
Cc: security-management@securityfocus.com
Subject: Re: Key Performance Indicators Information Security

Steven,

You are correct that information security metrics are still a rather
nascent. Good starting points for research are NIST SP800-55 [1] and the
Corporate Information Security Working Group report from 2004 [2]. I would
expect ISO/IEC27004 to provide additional authoritative guidance, though its
release is still a ways off. In addition, I put together a short write-up of
some of the challenges I have experienced building security metrics
programs; you might find it helpful[3].

Good luck!

-Dennis Opacki, CISSP QDSP

[1] http://csrc.nist.gov/publications/nistpubs/800-55/sp800-55.pdf
[2] http://www.cisecurity.org/Documents/
BPMetricsTeamReportFinal111704Rev11005.pdf
[3] http://www.infosecwriters.com/text_resources/pdf/BU_Scorecards.pdf


On Jun 3, 2006, at 10:48 PM, Salaets, Steven wrote:

> All,
>
>
> I am currently establishing a set of key performance indicators for  
> our
> security office and while looking around for general practices etc  
> I get
> the impression there is not much available out there. (or did I  
> look in
> the wrong places? ) Anybody has some feedback or online resources on
> KPI's within Information Security?
>
> -steven