Security metrics for the board
Apr 27th, 2020 by Jesper Kråkhede
In my previous post I wrote about measuring security posture. This one is for management. What should the board actually look at?
Not the number of blocked attacks. Every vendor will happily show you millions of blocked spam mails and scans. It looks impressive and tells you nothing about your risk. The board needs a handful of numbers that answer three questions. Are we protected against the attacks we know are common? How fast do we detect and react when something gets through? Can we recover if the worst happens?
For the first, look at things like the share of accounts with a second factor, devices patched on time and admin accounts that are protected. For the second, the time from detection to action. For the third, when the last full restore test was done and how long it took.
Put them on one page, with a trend and a target. If a number goes the wrong way, ask why and what it costs to fix. That is how you make security a business discussion instead of a technical one.
This spring has shown that the business can change completely in a week. The board needs to know if the security can keep up.
If you can´t measure it, you can´t manage it. And you definitely can´t budget for it.