How secure are you? Measure it
Apr 26th, 2020 by Jesper Kråkhede
When I ask customers how secure they are I usually get an answer like ‘pretty good’ or ‘better than last year’. That is a feeling, not a measurement.
Security posture is the overall state of your defences right now, and you can measure it more easily than you think. Microsoft Secure Score is one place to start if you are using Microsoft 365. It is far from perfect but it gives you a number, a list of improvements and a history. Combine it with a few simple metrics of your own.
How many accounts have admin rights? How many of them have a second factor? How many devices are managed and patched within 30 days? How many servers still run an operating system out of support? How many internet facing systems do we have and do we know all of them? How long does it take from an alert in the SOC until someone acts on it?
None of these require an expensive tool. Most can be pulled from systems you already have. Measure them every month and you will see the trend.
The important thing is to choose metrics that tell you if the risk goes down, not just if a project is done. ‘We installed the tool’ is not a metric. ‘90 % of our admins now use a PAW’ is.
What you measure gets fixed.