Security Metrics-Review and Research Directions

摘要

The critical nature of information security is largely dependent on society's reliance on information technology. As we continue to rely more heavily on information technology in our daily activities, the need for information security increases. It follows, therefore, that ways and means to measure information security posture need to be developed. A very well known cliche states that 'what cannot be measured cannot be improved.' This is the motivation behind this research. In this paper, we present a literature review of security metrics and other related concepts and lay the groundwork for future research on security metrics, performance dashboards, and key performance indicators.