Cyber and Technology Risk Management Forum, Park City, UT

7+( $57 2) &<%(56(&85,7< 0(75,&6

Complicating Security Metrics

Unable to distinguish PDOLFLRXV HYHQWV IURP QRQ HYHQWV

6RXUFH 0DWXULQJ DQG 6SHFLDOL]LQJ ,QFLGHQW 5HVSRQVH&DSDELOLWLHV 1HHGHG 6$16 6XUYH\ $XJXVW

0,67UDLQLQJ,QVWLWXWH ,QF ‹,QQRYDWLYH,7//&

6OLGH

,7*=

0,6 7UDLQLQJ ,QVWLWXWH ,QF

3DJH

,7*=

‹ LL7 &RQVXOWLQJ

7+( $57 2) &<%(56(&85,7< 0(75,&6

‰ %L $QQXDO 0HWULFV 2SHUDWLRQDO ƒ 3HUFHQWDJH RI LGHQWLILHG VHFXULW\ FRQWUROV LPSOHPHQWHG DW RU JUHDWHU ƒ 3HUFHQWDJH RI PRVW FXUUHQW 5LVN $VVHVVPHQW )LQGLQJV UHPHGLDWHG ‰ 4XDUWHUO\ 5HYLHZ 2SHUDWLRQDO ƒ 3HUFHQWDJH RI FULWLFDO ORJ ILOHV UHYLHZHG GDLO\ LQFOXGHV ILUHZDOO ORJV Example Security Metric(s)- Controls 0HHWV &ULWHULD Factual

Quantitative Comparative Measured consistently Actionable

0,67UDLQLQJ,QVWLWXWH ,QF ‹,QQRYDWLYH,7//&

6OLGH

,7*=

0,6 7UDLQLQJ ,QVWLWXWH ,QF

3DJH

,7*=

‹ LL7 &RQVXOWLQJ