Information Security Metrics: Summary of Using the Metrics
To sum up, there are several uses of information security metrics. These metrics are helpful in determining the strength and weakness of any information security system at any given point of time. While one can assess the effectiveness of a security system using the information security metrics, they also find the metrics useful in improving the information security systems. The information security metrics obtained from different sources can also be used to create an efficient information security system from scratch.
While creating an information security from scratch, the data is collected from different existing information security systems. The data should be enough to help create information security metrics. This also means that the information systems analyst must collect data more than once from each security system before creating the information security metrics. The difference in time offers more brevity to the metrics so that the analysts may study them and design the model of good and effective information security systems.
Besides, there are many more methods of employing the information security metrics once you understand them properly. The following links may prove beneficial for you to learn about information security metrics, the different methods to derive the metrics, and the many methods to use the information security metrics.
Article Sources
a. Federal Computer Week, 16 June 2006 (URL: http:www.fcw.com/article89546-07-13-05)
b. Federal Computer Week, 16 June 2006 (URL: http://www.fcw.com/article70756)
c. NIST and CSSPAB Workshop, Washington, D.C., 13-14 June 2000. (URL: http://csrc.nist.gov/csspab/june13-15/jelen.pdf)
d. Applied Computer Security Associates Workshop on Information-Security-System Rating and Ranking, Williamsburg, Virginia, 21-23 May 2001: 1-2. URL: (http://www.acsac.org/measurement)
Further Readings on Information Security Metrics
a. 13 Bayuk, Jennifer L. “Information Security Metrics: An Audited-based Approach.” NIST and CSSPAB Workshop, Washington, D.C., 14 June 2000. URL: http://csrc.nist.gov/csspab/june13-15/Bayuk.pdf (10 July 2001)
b. http://www.securitystats.com
c. http://www.cio.com
d. “A Few Good Metrics,” CSO Magazine, 1 July 2005. (URL: http://www.csoonline.com/read/070105/metrics.htmlhttp://www.csoonline.com/read/070105/metrics.html)
e. http://www.issea.org (16 June, 2006)
f. http://csrc.nist.gov/organizations/guidance/framework-final.pdf