Newton's take on security metrics
He may not have considered this at the time, but Sir Isaac Newton's three laws of motion are applicable to security metrics ...
Law 1. Every object in a state of uniform motion tends to remain in that state of motion unless an external force is applied to it.
An organization lacking effective metrics has no real impetus to change its approach to information security. Management doesn't know how secure or insecure it is, nor whether security is "sufficient", and has no rational basis for allocating resources to security, nor for spending the budget on security activities that generate the most value. Hence, they carry on doing pretty much what they've always done. They approve the security budget on the basis of "last year's figure, plus or minus a bit". They do security compliance activities under sufferance, and at the last possible moment.
The law of inertia is particularly obvious in the case of large bodies that continue to blunder through situations that smaller, more nimble and responsive ones avoid. We're not going to name names here: simply check the blogosphere and news media for plenty of unfortunate examples of sizable, generally bureaucratic, often governmental organizations that continue to experience security incident after incident after incident. Management shrugs off adverse audit reports, inquiries and court cases as if it's not their fault. "Our hands are tied", they bleat, "don't blame us!" and messrs Sarbanes and Oxley groan.
By the same token, the auditors, investigators, courts and other stakeholders lack the data to state, definitively, that "You are way behind on X, and totally inadequate on Y". They know things are Not Quite Right, but they're not entirely sure what or why. Furthermore, those who mandate various security laws, regulations and edicts have only the vaguest notion about what's truly important, and what would have the greatest effect. Mostly they're guessing too.
The law of inertia is particularly obvious in the case of large bodies that continue to blunder through situations that smaller, more nimble and responsive ones avoid. We're not going to name names here: simply check the blogosphere and news media for plenty of unfortunate examples of sizable, generally bureaucratic, often governmental organizations that continue to experience security incident after incident after incident. Management shrugs off adverse audit reports, inquiries and court cases as if it's not their fault. "Our hands are tied", they bleat, "don't blame us!" and messrs Sarbanes and Oxley groan.
By the same token, the auditors, investigators, courts and other stakeholders lack the data to state, definitively, that "You are way behind on X, and totally inadequate on Y". They know things are Not Quite Right, but they're not entirely sure what or why. Furthermore, those who mandate various security laws, regulations and edicts have only the vaguest notion about what's truly important, and what would have the greatest effect. Mostly they're guessing too.
Law 2. The relationship between an object's mass m, its acceleration a, and the applied force F is F = ma.
Applying a force to an object accelerates or decelerates it. The amount of acceleration/deceleration is proportional to the force applied and the mass of the object. Do we honestly need to spell out how eloquently this describes metrics? For those of you who whispered "Yes!" we'll simply mention the concepts of proportional control and feedback. Nuff said.
Law 3. For every action there is an equal and opposite reaction.
An interesting one, this.
Once organizations are designing, developing, selecting, implementing, using, managing and improving their suites of PRAGMATIC information security metrics, they will inevitably start using the metrics to make changes that systematically and measurably improve their security. That's the action part.
Newton might predict a reaction: what would that be?
Well, one reaction will involve the human threats such as hackers, malware authors, fraudsters, spies and so forth: they will up their game in order to continue successfully exploiting those victims who are more secure, or of course direct their evil attentions to less secure victims, including those who lack security metrics and hence presumably still manage, direct and resource security using guesswork, gut feel, magic incantations, lucky charms and astrology. "I've heard on the golf course|read in the in-flight magazine|been told by a little bird that competitor X only spends 5% of its IT budget on security. Clearly, we're spending far too much!"
Another reaction will involve other parts of the organization - other departments who notice that, for once, information security has management's ear. They are successfully justifying the security budgets and investments that they themselves would love to have. Some will react negatively, challenging and undermining the security metrics out of jealousy and a desire to go back to the good old days (law 1 in action), while others will seize the opportunity to reevaluate their own metrics, finding their own PRAGMATIC set.
Yet another reaction will come from the authorities, owners and other stakeholders who can't help but notice the marked contrast between PRAGMATIC and non-PRAGMATIC organizations. The former give them fact-based, reliable and most of all useful information about their information security status and objectives, while the latter mysteriously hint at celestial bodies and rabbits' feet. We confidently predict that security compliance obligations imposed on organizations will increasingly specify PRAGMATIC metrics, and indeed the PRAGMATIC approach, as part of the deal.
Let's be realistic about it: the change will undoubtedly be incremental and subtle at first, starting with the thought leaders and innovators who grasp PRAGMATIC and make it so. Gradually, the language of security metrics will change as the early adopters enthuse about their new-found abilities to manage security more rationally and scientifically than has been possible before, and others come to appreciate that at last they can make sense of the metrics mumbo-jumbo spouted by the consultants and standards. The laggards who cling to their existing approaches like a drowning man clings to a sodden log will face extinction through increasing security threats and incidents, and increasingly strident pressure from their stakeholders to "be honest about security".