www.darkreading.com Open in urlscan Pro
2606:4700::6812:6c2f  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Dark Reading is part of the Informa Tech Division of Informa PLC
Informa PLC|ABOUT US|INVESTOR RELATIONS|TALENT
This site is operated by a business or businesses owned by Informa PLC and all
copyright resides with them. Informa PLC's registered office is 5 Howick Place,
London SW1P 1WG. Registered in England and Wales and Scotlan. Number 8860726.

Black Hat NewsOmdia Cybersecurity

Newsletter Sign-Up

Newsletter Sign-Up

Cybersecurity Topics

RELATED TOPICS

 * Application Security
 * Cybersecurity Careers
 * Cloud Security
 * Cyber Risk
 * Cyberattacks & Data Breaches
 * Cybersecurity Analytics
 * Cybersecurity Operations
 * Data Privacy
 * Endpoint Security
 * ICS/OT Security

 * Identity & Access Mgmt Security
 * Insider Threats
 * IoT
 * Mobile Security
 * Perimeter
 * Physical Security
 * Remote Workforce
 * Threat Intelligence
 * Vulnerabilities & Threats


World

RELATED TOPICS

 * DR Global

 * Middle East & Africa

See All
The Edge
DR Technology
Events

RELATED TOPICS

 * Upcoming Events

 * Webinars

SEE ALL
Resources

RELATED TOPICS

 * Library
 * Newsletters
 * Reports
 * Videos
 * Webinars
 * Whitepapers

 * 
 * 
 * 
 * 
 * Partner Perspectives:
 * > Microsoft

SEE ALL


Sponsored By

 * Cybersecurity Analytics
 * Cyber Risk

Cybersecurity In-Depth: Feature articles on security strategy, latest trends,
and people to know.




10 SECURITY METRICS CATEGORIES CISOS SHOULD PRESENT TO THE BOARD

Boards of directors don't care about a security program's minute technical
details. They want to see how key performance indicators are tracked and used.

Ericka Chickowski, Contributing Writer

February 15, 2024

6 Min Read
Source: ConceptCafe via Alamy Stock Photo


With the US Securities and Exchange Commission requiring CISOs and boards of
directors to increase the level of transparency around their organizations'
cybersecurity capabilities and to speed up breach disclosure to investors, cyber
reporting and metrics have become an even bigger priority for companies this
year.

Boards are turning the screws to their security and risk executives to bring a
lot more rigor to how they track key performance indicators (KPIs) and key risk
indicators (KRIs) — and how they use these metrics to advise and report to the
board. Fundamental to both KPIs and KRIs are security operational metrics that
track the scope of assets, cybersecurity activities around those assets, and
measured security outcomes.



"Security teams use operational metrics to track and report on cybersecurity
activities and outcomes," explains The Cyber Savvy Boardroom, a recent primer
published by a pair of longtime cyber-risk leaders to help directors and
executive leaders wrap their arms around cyber issues. "When shared with the
board of directors’ risk or audit committees, these key performance indicators
illuminate the organization’s cybersecurity capabilities and the efficiency of
cyber controls while also helping the board of directors evaluate the adequacy
of investments in technology and talent."



Co-authored by Homaira Akbari, CEO of global advisory firm AKnowledge Partners,
and Shamla Naidoo, head of cloud strategy for Netskope, the book covers a lot of
ground, but some of the most vital parts of the primer focus on metrics. Dark
Reading summarizes and excerpts from the tome here to present the most common
metrics that Akbari and Naidoo believe to be crucial for CISOs to track and
share with the board in order to report on risk levels and security performance.



The caveat, of course, is that security leaders need to be able to roll up these
metrics into assessments and dashboards that are easy to digest. As explained in
the primer, the metrics detailed in each category create a data-backed model for
determining the efficacy of an organization's program and identifying gaps in
protection.

"The conclusions of these assessments should be summarized in several overall
ratings and included in the company’s cybersecurity dashboard," Akbari and
Naidoo explain.


DATA

These metrics should scope risk around data assets and track performance in key
protection measures for data security, resilience, and continuity. Some of the
metrics Akbari and Naidoo advise CISOs to track in this category include:



 * % data centralized

 * % data encrypted

 * Backup frequency

 * Speed of data recovery

 * % employee/customer/user info on Dark Web

 * Depth of data-lake segmentation


FINANCIAL ASSETS

Financial asset risks and losses are included in this grouping of metrics, which
should give a measured feel for financial consequences from recent breaches.
Some metrics the authors suggest tracking (based on past quarters or over the
past year) include:

 * Value of actual money/crypto lost directly

 * Value of money or productivity losses in form of ransomware

 * Volume of financial data leaked (accounts, credit cards, loyalty points,
   online banking credentials)

While not specifically listed, data on financial losses from business email
compromise (BEC) and indirect breach response costs would also be valuable to
track.


PEOPLE

Whether it is falling prey to phishing or BEC attacks — exposing data by not
following policy or exposing systems in other ways — people are usually an
enterprise's biggest vulnerability. While it may be hard to measure the efficacy
of security awareness training, there are some good proxies to get a general
sense of how well an organization's people are adhering to security best
practices and policies. The authors suggest the following metrics in this
category:



 * % phishing email click-through

 * % suspicious email reported

 * Passwords hacked

 * Privileged accounts to total accounts

 * % employees moving data/files out of the enterprise

Other metrics not directly mentioned but are still relevant include the results
from phishing simulations, knowledge assessment scores, and behavioral or
account data about high-risk individuals.


SUPPLIERS

With third-party risk management and the digital supply chain security on the
forefront of many executives' minds in the wake of events like SolarWinds,
boards will want to be informed of supplier-related security operations risks
and performance levels. Akbari and Naidoo believe CISOs would do well to keep
the business attuned to trending data and metrics around:

 * Self-certification of cybersecurity posture of third parties

 * External scoring against peers and industry

 * Continuous monitoring of posture of third and fourth parties

 * External audit compliance

 * Penetration testing scores (from suppliers)

Data about suppliers will likely have a lot of overlap with metrics about
enterprise applications (see below), as application security teams start to look
at software supply chain risk, including risky dependencies from third-party
code and components.


INFRASTRUCTURE

Whether on-premises or in the cloud, IT infrastructure exposures and security
capabilities in mitigating risks across the network and hardware assets should
be appropriately monitored and measured. Some operational data that the authors
suggest in this category include metrics around:

 * Number of servers/hardware approaching end of life

 * Secure configurations of all assets

 * Depth of network/ infrastructure segmentation

 * Level of automation of inventory and control of hardware assets

 * Vulnerability scanning

 * Depth of zero-trust architecture deployment: identity, device, access,
   services




USER-CONTROLLED DEVICES

CISOs should be able to give board members a feel for the level of control their
organizations have over shadow IT and other user-controlled devices operating on
the network. Akbari and Naidoo say the following common metrics should be on the
radar:

 * Number of unidentified devices on the network

 * Number of devices with unpatched software

 * Rate of false positives

 * Number of threats detected and prevented by the endpoint solution


NEW TECHNOLOGIES: IOT

The scope and scale of Internet of Things (IoT) devices has opened up
significant risk to enterprises over the course of the past decade. The authors
suggest that CISOs provide some risk metrics around these, including:

 * Number of non-upgradable or patchable IoT devices

 * Number of IoT ports connecting to enterprise networks

 * Depth of loT segmentation from enterprise resources

While the focus is currently on IoT, the same approach could work for all
emerging technology. AI, for example, could include metrics around AI use and —
with some emerging AI security tooling — risk exposure levels from AI use in the
organization.


ENTERPRISE APPLICATIONS

Whether it is from commercial software or applications developed in-house,
applications present some of the biggest attack surfaces in the enterprise
today. Akbari and Naidoo offer a couple of common metrics boards should be
apprised of:

 * Known open software vulnerabilities

 * Software patches outstanding

 * Number of zero-day software vulnerabilities

There is no shortage of additional application security data and metrics that
can help track performance and risk levels across application portfolios.
Consider including data such as rate of automated versus manual code review,
time to fix critical vulnerabilities, open rate of critical vulnerabilities, and
metrics that add context about exploitability or business value of assets with
known critical flaws.


TESTING SECURITY POSTURE

Security validation and testing is an important part of a security program, so
CISOs should be beholden to track not only the results from security tests, but
also the rate at which they conduct testing. Some metrics that fall into this
category, according to Akbari and Naidoo, are:



 * Penetration(red, blue) testing

 * Independent external security ratings versus peers and the industry

 * Internal/external auditor report on regulatory and cyber compliance

 * Application and other testing scores and discoveries


INCIDENT DETECTION AND RESPONSE

Boards of directors will be very interested in a security team's ability to
detect and respond to incidents. Akbari and Naidoo recommend some of the
following common ops metrics to track this:

• Volumes and % of actual incidents versus intrusion attempts

• Mean time to detect

• Mean time to contain

• Mean time to remediate/resolve

• Red team scores and discoveries

Additionally, CISOs may benefit from offering metrics and results from tabletop
exercises and attack simulations if these are activities they engage in.




ABOUT THE AUTHOR(S)

Ericka Chickowski, Contributing Writer



Ericka Chickowski specializes in coverage of information technology and business
innovation. She has focused on information security for the better part of a
decade and regularly writes about the security industry as a contributor to Dark
Reading.

See more from Ericka Chickowski, Contributing Writer
Keep up with the latest cybersecurity threats, newly discovered vulnerabilities,
data breach information, and emerging trends. Delivered daily or weekly right to
your email inbox.

Subscribe

You May Also Like

--------------------------------------------------------------------------------

Cybersecurity Analytics

eSentire Labs Open Sources Project to Monitor LLMs
Cybersecurity Analytics

Securonix: Making Sense of AI’s Rapid Acceleration in Cybersecurity
Cybersecurity Analytics

Cyber Insurance Experts Make a Case for Coverage, Protection
Cybersecurity Analytics

CISOs Need Backing to Take Charge of Security
More Insights
Webinars

 * Making Sense of Security Operations Data
   
   Feb 21, 2024

 * Unbiased Testing. Unbeatable Results
   
   Feb 22, 2024

 * Your Everywhere Security Guide: 4 Steps to Stop Cyberattacks
   
   Feb 27, 2024

 * API Security: Protecting Your Application's Attack Surface
   
   Feb 29, 2024

 * Securing the Software Development Life Cycle from Start to Finish
   
   Mar 06, 2024

More Webinars
Events

 * Cybersecurity's Hottest New Technologies - Dark Reading March 21 Event
   
   Mar 21, 2024

 * Black Hat Asia - April 16-19 - Learn More
   
   Apr 16, 2024

 * Black Hat Spring Trainings - March 12-15 - Learn More
   
   Mar 12, 2024

More Events

Latest Articles in The Edge

 * 10 Security Metrics Categories CISOs Should Present to the Board
   
   Feb 14, 2024
   |
   6 Min Read

 * How Changes in State CIO Priorities for 2024 Apply to API Security
   
   Feb 12, 2024
   |
   4 Min Read

 * Why Demand for Tabletop Exercises Is Growing
   
   Feb 8, 2024
   |
   5 Min Read

 * As Smart Cities Expand, So Do the Threats
   
   Feb 6, 2024
   |
   5 Min Read

Read More The Edge





DISCOVER MORE WITH INFORMA TECH

Black HatOmdia

WORKING WITH US

About UsAdvertiseReprints

JOIN US


Newsletter Sign-Up

FOLLOW US



Copyright © 2024 Informa PLC Informa UK Limited is a company registered in
England and Wales with company number 1072954 whose registered office is 5
Howick Place, London, SW1P 1WG.

Home|Cookie Policy|Privacy|Terms of Use

Cookies Button


ABOUT COOKIES ON THIS SITE

We and our partners use cookies to enhance your website experience, learn how
our site is used, offer personalised features, measure the effectiveness of our
services, and tailor content and ads to your interests while you navigate on the
web or interact with us across devices. You can choose to accept all of these
cookies or only essential cookies. To learn more or manage your preferences,
click “Settings”. For further information about the data we collect from you,
please see our Privacy Policy

Accept All
Settings



COOKIE PREFERENCE CENTER

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All


MANAGE CONSENT PREFERENCES

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms.    You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.

Cookies Details‎

PERFORMANCE COOKIES

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site.    All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

Cookies Details‎

FUNCTIONAL COOKIES

Functional Cookies

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages.    If you do not allow these cookies then
some or all of these services may not function properly.

Cookies Details‎

TARGETING COOKIES

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites.    They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Cookies Details‎
Back Button


BACK



Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

 * 
   
   View Cookies
   
    * Name
      cookie name

Confirm My Choices