When I ask customers how secure they are I usually get an answer like \u2018pretty good\u2019 or \u2018better than last year\u2019. That is a feeling, not a measurement.<\/p>\n
Security posture is the overall state of your defences right now, and you can measure it more easily than you think. Microsoft Secure Score is one place to start if you are using Microsoft 365. It is far from perfect but it gives you a number, a list of improvements and a history. Combine it with a few simple metrics of your own.<\/p>\n
How many accounts have admin rights? How many of them have a second factor? How many devices are managed and patched within 30 days? How many servers still run an operating system out of support? How many internet facing systems do we have and do we know all of them? How long does it take from an alert in the SOC until someone acts on it?<\/p>\n
None of these require an expensive tool. Most can be pulled from systems you already have. Measure them every month and you will see the trend.<\/p>\n
The important thing is to choose metrics that tell you if the risk goes down, not just if a project is done. \u2018We installed the tool\u2019 is not a metric. \u201890 % of our admins now use a PAW\u2019 is.<\/p>\n
What you measure gets fixed.<\/p>\n","protected":false},"excerpt":{"rendered":"
When I ask customers how secure they are I usually get an answer like \u2018pretty good\u2019 or \u2018better than last year\u2019. That is a feeling, not a measurement. Security posture is the overall state of your defences right now, and you can measure it more easily than you think. Microsoft Secure Score is one place […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[66,65,64],"class_list":["post-1208","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-secure-score","tag-security-metrics","tag-security-posture"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1208","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1208"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1208\/revisions"}],"predecessor-version":[{"id":1236,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1208\/revisions\/1236"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1208"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1208"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1208"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}