Home > Store > Security > Network Security
Security Metrics: Replacing Fear, Uncertainty, and Doubt
- By Andrew Jaquith
- Published Mar 26, 2007 by Addison-Wesley Professional.
- Copyright 2007
- Dimensions: 7x9-1/4
- Pages: 336
- Edition: 1st
- Book
- ISBN-10: 0-321-34998-9
- ISBN-13: 978-0-321-34998-9
Register your product to gain access to bonus material or receive a coupon.
Product Author Bios
Andrew Jaquith is the program manager for Yankee Group’s Enabling Technologies Enterprise group, with expertise in compliance, security, and risk management. Jaquith advises enterprise clients on how to manage security resources in their environments. He also helps security vendors develop strategies for reaching enterprise customers. Jaquith’s research focuses on topics such as security management, risk management, and packaged and custom web-based applications.
Jaquith has 15 years of IT experience. Before joining Yankee Group, he cofounded and served as program director at @stake, Inc., a security consulting pioneer, which Symantec Corporation acquired in 2004. Before @stake, Jaquith held project manager and business analyst positions at Cambridge Technology Partners and FedEx Corporation.
His application security and metrics research has been featured in CIO, CSO, InformationWeek, IEEE Security and Privacy, and The Economist. In addition, Jaquith contributes to several security-related open-source projects.
Jaquith holds a B.A. degree in economics and political science from Yale University.
<>The Definitive Guide to Quantifying, Classifying, and Measuring Enterprise IT Security Operations
Security Metrics is the first comprehensive best-practice guide to defining, creating, and utilizing security metrics in the enterprise.
Using sample charts, graphics, case studies, and war stories, Yankee Group Security Expert Andrew Jaquith demonstrates exactly how to establish effective metrics based on your organization’s unique requirements. You’ll discover how to quantify hard-to-measure security activities, compile and analyze all relevant data, identify strengths and weaknesses, set cost-effective priorities for improvement, and craft compelling messages for senior management.
Security Metrics successfully bridges management’s quantitative viewpoint with the nuts-and-bolts approach typically taken by security professionals. It brings together expert solutions drawn from Jaquith’s extensive consulting work in the software, aerospace, and financial services industries, including new metrics presented nowhere else. You’ll learn how to:
• Replace nonstop crisis response with a systematic approach to security improvement
• Understand the differences between “good” and “bad” metrics
• Measure coverage and control, vulnerability management, password quality, patch latency, benchmark scoring, and business-adjusted risk
• Quantify the effectiveness of security acquisition, implementation, and other program activities
• Organize, aggregate, and analyze your data to bring out key insights
• Use visualization to understand and communicate security issues more clearly
• Capture valuable data from firewalls and antivirus logs, third-party auditor reports, and other resources
• Implement balanced scorecards that present compact, holistic views of organizational security effectiveness
Whether you’re an engineer or consultant responsible for security and reporting to management–or an executive who needs better information for decision-making–Security Metrics is the resource you have been searching for.
Andrew Jaquith, program manager for Yankee Group’s Security Solutions and Services Decision Service, advises enterprise clients on prioritizing and managing security resources. He also helps security vendors develop product, service, and go-to-market strategies for reaching enterprise customers. He co-founded @stake, Inc., a security consulting pioneer acquired by Symantec Corporation in 2004. His application security and metrics research has been featured in CIO, CSO, InformationWeek, IEEE Security and Privacy, and The Economist.
Foreword
Preface
Acknowledgments
About the Author
Chapter 1 Introduction: Escaping the Hamster Wheel of Pain
Chapter 2 Defining Security Metrics
Chapter 3 Diagnosing Problems and Measuring Technical Security
Chapter 4 Measuring Program Effectiveness
Chapter 5 Analysis Techniques
Chapter 6 Visualization
Chapter 7 Automating Metrics Calculations
Chapter 8 Designing Security Scorecards
Index
Related Article
Talk Is Cheap: Why the Security Industry Needs to Improve Its Bedside Manner
Author's Site
Visit the author's web site: www.securitymetrics.org
|
35 of 36 people found the following review helpful
A ground-breaking book that all security managers should read, By
This review is from: Security Metrics: Replacing Fear, Uncertainty, and Doubt (Paperback)
I read Security Metrics right after finishing Managing Cybersecurity Resources, a book by economists arguing that security decisions should be made using cost-benefit analysis. On the face of it, cost-benefit analysis makes perfect sense, especially given the authors' analysis. However, Security Metrics author Andy Jaquith quickly demolishes that approach (confirming the problem I had with the MCR plan). While attacking the implementation (but not the idea) of Annual Loss Expectancy for security events, Jaquith writes on p 33 "[P]ractitioners of ALE suffer from a near-complete inability to reliably estimate probabilities [of occurrence] or losses." Bingo, game over for ALE and cost-benefit analysis. It turns out the reason security managers "herd" (as mentioned in MCR) is that they have no clue what else to do; they seek safety in numbers by emulating peers and then claim that as a defense when they are breached.Fortunately, Security Metrics offers another solution... Read more
18 of 19 people found the following review helpful
Arithmophobes, unite! You have nothing to lose but your Threat Level color wheels., By
This review is from: Security Metrics: Replacing Fear, Uncertainty, and Doubt (Paperback)
It's difficult to imbue a book on metrics with something other than academic theories, but Jaquith offers the working security professional a tangible lifeline. Nearly all of his suggested metrics are within easy reach, thanks to a commonsense approach and a tie-in to the instrumentation you're most likely to have in your data center.Don't be scared off by the term "metrics," either; it's an easy read, chock full of amusing stories and turns of phrase (I thought my 80-year-old father was the only one who said "'pert near"). Jaquith focuses on the practical, from What Not to Draw (a graphics primer for charts and tables) to a Balanced Scorecard Makeover that actually looks achievable from outside the C-suite. If your boss likes metrics, and your budget request is in jeopardy, you can't do better than this guide to making your case. Now, if only we had a practical, lightweight risk analysis methodology to go along with it ...
18 of 20 people found the following review helpful
Should be in the hands of every security professional.,
This review is from: Security Metrics: Replacing Fear, Uncertainty, and Doubt (Paperback)
The goal of security metrics is to replace fear, uncertainty, and doubt (FUD) with a more formalized and meaningful system of measurement. The FUD factor is the very foundation upon which much of information security is built, and the outcome is decades of meaningless statistics and racks of snake oil products. Let's hope that Andrew Jaquith succeeds, but in doing so, he is getting in the way of many security hardware and software vendors whose revenue streams are built on FUD.One could write a book on how FUD sells security products. One of the most memorable incidents was in 1992 when John McAfee created widespread panic about the impending Michelangelo virus. The media was all over him as he was selling solutions for the five million PCs worldwide he said would be affected. The end result is that the Michelangelo virus was a non-event. Nonetheless, it was far from the last time that FUD was used to sell security. The allure of FUD is that companies can... Read more |
Online Sample Chapter
Visualization: How to Present Security Data to Get Your Point Across
Table of Contents
Foreword xv
Preface xix
Acknowledgments xxv
About the Author xxviii
Chapter 1 Introduction: Escaping the Hamster Wheel of Pain 1
Chapter 2 Defining Security Metrics 9
Chapter 3 Diagnosing Problems and Measuring Technical Security 39
Chapter 4 Measuring Program Effectiveness 89
Chapter 5 Analysis Techniques 133
Chapter 6 Visualization 157
Chapter 7 Automating Metrics Calculations 217
Chapter 8 Designing Security Scorecards 251
Index 301
Preface
Downloadable Sample Chapter
Foreword
This book includes free shipping!
This book includes free shipping!
eBook (Watermarked)
$47.99
$38.39
Includes EPUB, MOBI, and PDF
About eBook Formats
This eBook includes the following formats, accessible from your Account page after purchase:
EPUBThe open industry format known for its reflowable content and usability on supported mobile devices.
MOBIThe eBook format compatible with the Amazon Kindle and Amazon Kindle applications.
PDFThe popular standard, used most often with the free Adobe® Reader® software.
This eBook requires no passwords or activation to read. We customize your eBook by discretely watermarking it with your name, making it uniquely yours.
- Request an Instructor or Media review copy.
- Corporate, Academic, and Employee Purchases
- International Buying Options
Get access to thousands of books and training videos about technology, professional development and digital media from more than 40 leading publishers, including Addison-Wesley, Prentice Hall, Cisco Press, IBM Press, O'Reilly Media, Wrox, Apress, and many more. If you continue your subscription after your 30-day trial, you can receive 30% off a monthly subscription to the Safari Library for up to 12 months. That's a total savings of $199.
