INFORMATION SECURITY MANAGEMENT METRICS: A DEFINITIVE GUIDE TO EFFECTIVE SECURITY MONITORING AND MEASUREMENT

摘要

Measuring information security is the greatest remaining challenge for many of us. Metrics are essential for a scientific management approach, rather than relying purely on gut feel and guesswork. Standards such as ISO/IEC 27001 require the use of objective information about the status and effectiveness of information security controls in relation to the risks, in order to drive appropriate improvements in the organization's Information Security Management System (ISMS). However, it is not immediately obvious exactly what needs measuring, nor how to do it. This book lays out the foundations on which a rational measurement system can be designed to manage information security in a more objective fashion.