ISSA Sacramento: Security Metrics - So What?

ISSA SACRAMENTO
SECURITY METRICS – SO WHAT?

WILLIAM TANG, CTO
09/17/2010

ALLGRESS, INC.
© 2009 ALLGRESS, INC. 1
2600 Kitty Hawk Road ∙ Suite 109 ∙ Livermore, CA 94551 ∙ www.allgress.com

Security Metrics – So What?

• Why are we gathering metrics?

• Who are we gathering these metrics for?

• What will we do with the metrics, once
we have them?
ALLGRESS, INC.

What You Will Learn?
• Techniques to influence business decision
makers.

• Simple ways to demonstrate security value.

• How to align security strategy with the
business.

ALLGRESS, INC.

IT Security’s Job Description

Minimize Security Risk
&
Maximize Business Value

Business and security metrics are needed to
demonstrate and communicate both objectives.
ALLGRESS, INC.

Presentation Outline
• Introduction Exercise

• Be More Effective

• Demonstrate Security Value

• Conclusion

ALLGRESS, INC.

If You Were a CFO, COO, or Exec…
• This is the language you would speak:
– Discount Rate
– Leverage Ratio
– Covenants
– Net Debt Free Cash Flow
– EBITDA, EPS, Beta, etc…
If this sounds like a foreign language, imagine
how they feel when we use IT security terms…
ALLGRESS, INC.

Which Statement for Exec Mgmt?

A. We have 2,300 CVSS severity 4 and 5
vulnerabilities on our 400 Windows Servers.

B. The IT systems that generate 30% of our
revenue have critical security vulnerabilities.

ALLGRESS, INC.




• Conclusion

ALLGRESS, INC.

Choose Wisely

Security Business
Metrics Metrics

Useful Metrics
(for your intended audience)
ALLGRESS, INC.

Example: Risk & Revenue
• ‘Bubbles’ represent
business units (BU).

This BU generates 30% of revenue, but it has high risk. • Size of the bubble
represents the BU
percentage revenue ($).
• NIST Risk Methodology
(tech scans & audits).
IT systems that generate
30% revenue has critical
vulnerabilities and risk.
Does this make business
sense?
Low Risk Medium Risk High Risk
ALLGRESS, INC.

Example: Escape Fire Fighting Mode
• PCI compliance scans from
Qualys.
• Results grouped by operating
system or asset type.

For this client, the typical
approach to PCI compliance is
to mitigate each vulnerability
one by one.

ALLGRESS, INC.

Example: Escape Fire Fighting Mode
• Same Qualys data as before,
but now grouped by
vulnerability type.

Is there a strategic solution
here? Can the client focus on
preventing these common
vulnerabilities from happening
in the first place?

ALLGRESS, INC.

Example: Naughty Business Unit
• Wedges represent labor hours
for fixing security vulnerabilities
for each Business Unit.
Los Angeles • Leverage any vulnerability
scanning tool.
New York
• Link with estimates for
remediation, Remedy trouble
Austin tickets or a timesheet system.
Boston
If the LA Office has the most IT
systems, why is so much time
spent on Boston? Does it have
more vulnerabilities?
ALLGRESS, INC.




• Conclusion

ALLGRESS, INC.

Example: Risk Reduction Per $
• ‘Bubble’ can represent
any business metric.
• Demonstrate changes
Year 1 in risk over time
(trending).
We can calculate the
Year 2
changes in risk and costs
to show how effective
Year 3 investments in security
reduce risk. Or how
reducing investments in
security increase risk.
ALLGRESS, INC.

Example: Risk Reduction Per $

Demo of Risk Trending

ALLGRESS, INC.

Example: Prove Cost Savings
• Web Servers required
1,034 labor hours to
mitigate vulnerabilities.
• Mail Service
Web Servers vulnerabilities required
1,014 labor hours.
Mail Services
• Total is 2,048 hours.
• Assume the average
labor hour is $100/hr.

ALLGRESS, INC.

October 2009 January 2010
Implement training and Scans for this quarter show
awareness to system admins that vulnerability count has
to prevent vulnerabilities with decreased by 40%. As a result
change control and patching labor hours have also
processes. decreased by approx 40%
• Hours = 2,048 • Hours = 1,200
• Labor Cost = $100/hr • Labor Cost = $100/hr
• Total Cost = $20,480 • Total Cost = $12,000

Estimated Cost Savings = $8,480
ALLGRESS, INC.

October 2009 January 2010

CLOSED PENDING OPEN
NOTE: These graphs represent compliance findings and tasks. A similar exercise can be done to show improvements in
compliance and audit mitigation costs.
ALLGRESS, INC.

Example: Align With The Business

ALLGRESS, INC.




• Conclusion

ALLGRESS, INC.

Allgress Solution Objectives

Minimize Security Risk
&
Maximize Business Value

Allgress Security Life Cycle Manager helps our
customers meet these objectives quickly, with
minimal cost and effort.
ALLGRESS, INC.

Parting Words of Wisdom
Dave Cullinane
CISO

“Being able to demonstrate that we’re spending the
money the right way, spending the money effectively,
producing the results that are needed and ensuring that
level of confidence in the marketplace we offer is really
critical, and Allgress has been way beyond anything else
I’ve seen at being able to do that.”
Full webinar at http://www.allgress.com/webinars
ALLGRESS, INC.

Q&A

William Tang
Chief Technology Officer
Allgress, Inc.

Email: william.tang@allgress.com
Direct: 310.383.2783
FAX: 310.496.0426

www.allgress.com

ALLGRESS, INC.

ISSA Sacramento: Security Metrics - So What?

Recomendados

Recomendados

Más contenido relacionado

Destacado

Destacado (15)

Similar a ISSA Sacramento: Security Metrics - So What?

Similar a ISSA Sacramento: Security Metrics - So What? (20)

ISSA Sacramento: Security Metrics - So What?