Effective Operational Security Metrics

Abstract Security professionals are constantly being asked to justify every security project. Security risks and projects can often be difficult to measure and even more difficult to understand by people outside the department. The key to demonstrating improvement and value is to translate security information into business terms. This being the case, the ability to identify the type, quantity, frequency, audience, and presentation of appropriate security metrics can increase the value of a CISO or security professional from the perspective of the management team.