How Secure is Our Information Infrastructure

摘要

Managers of critical information infrastructures need better tools for managing risk than the qualitative or compliance-based metrics commonly used today in critical infrastructure protection. This paper provides a performance-based metric that can be used to obtain a quantitative measure of the security of information infrastructures. The metric can be used to compare the security status of different information infrastructures, or to track the evolution of security within a single infrastructure. Since, as all managers know, 'If you can't measure it, you can't manage it', the methodology presented here will improve managers' ability to successfully protect critical information infrastructures.