Security
Drive launched to create uniform IT security metrics
Regulatory and audit measurements don't tell the whole story
By Jeremy Kirk, IDG News Service | Published 08:50, 08 September 08
The Center for Internet Security (CIS) is set to release guidelines for how enterprises can measure the state of their organisation's security and launch a service for companies to compare their performance with their peers.
The latest CIS project is aimed at resolving the confusion and lack of uniformity in ways to measure whether an enterprise or organisation's IT security is improving or not, said Bert Miuccio, CIS's CEO.
Also in this channel
Virtualisation, Big Data and BYOD
Check out our Business IT Hub for opinions and briefings. Read more
"The problem that we've come to recognise is that information security professionals really are growing more confused on how to define success," Miuccio said. "They know that compliance with regulatory requirements and audit frameworks do not necessarily result in improved security and are not the best measures of success."
CIS is a non-profit organisation funded by enterprises and other organisations with an interest in security. Since it was formed in 2000, it has created 40 benchmarks for default security configurations for software ranging from operating systems to middleware to network devices. The benchmarks, which are a free download on the CIS Web site, are intended to help organisations reduce IT security risks.
Every security professional has different definitions for how to evaluate security measures, Miuccio said. CIS has assembled 85 information security experts to agree upon methods to measure eight different metrics. The metrics should be released in late October or early November, Miuccio said.
Two are "outcome" metrics: the mean time between security incidents and the mean time to recover from security incidents.
The remaining six are related to process: the percentage of systems configured to approved standards; the percentage of systems patched to policy; percentage of systems with antivirus technology; percentage of business applications that has a risk assessment; percentage of business applications that has a penetration or vulnerability assessment; and percentage of application code that has a security assessment or code review before deployment.
Along with the metrics, CIS plans to launch around the same time a software-based service for companies to compare how they are doing, in terms of security, against other anonymous companies in their market vertical. This type of comparison is already commonly used for financial results and other aspects of business performance such as customer service.
"That's not done in information security today," Miuccio said. "We believe that this service will begin to enable that."
