Shades of Green
2016
Security metrics are desirable when they enable something, when they have a role to perform that has a receiver ready to make use of them. Otherwise they are stamp collecting. The issue is one of purpose. The only purpose that makes security metrics worthy of pursuit is that of decision support, where the question being studied is one more of trajectory than exactly measured position. We are not in this for reasons of science, though those that are in it for science (or philosophy) will also want measurement of some sort to backstop their theorizing. We are in this because the scale of the task compared to the scale of our tools demand force multiplication. No game play improves without a way to keep score.
CyberGreen’s number one goal is to detect the precursors to attacks, especially to denial of service attacks; assuming that the motivation to attack will always be available, our job is to measure its opportunity. While it is true that vulnerable endpoints can be used for any bad activity, we cannot measure some kinds of bad activity so must stick to those we can measure and to the point, measure in a way that is solid decision support.
Shades of Green
2016
Security metrics are desirable when they enable something, when they have a role to perform that has a receiver ready to make use of them. Otherwise they are stamp collecting. The issue is one of purpose. The only purpose that makes security metrics worthy of pursuit is that of decision support, where the question being studied is one more of trajectory than exactly measured position. We are not in this for reasons of science, though those that are in it for science (or philosophy) will also want measurement of some sort to backstop their theorizing. We are in this because the scale of the task compared to the scale of our tools demand force multiplication. No game play improves without a way to keep score.
CyberGreen’s number one goal is to detect the precursors to attacks, especially to denial of service attacks; assuming that the motivation to attack will always be available, our job is to measure its opportunity. While it is true that vulnerable endpoints can be used for any bad activity, we cannot measure some kinds of bad activity so must stick to those we can measure and to the point, measure in a way that is solid decision support.
Shades of Green
2016
Security metrics are desirable when they enable something, when they have a role to perform that has a receiver ready to make use of them. Otherwise they are stamp collecting. The issue is one of purpose. The only purpose that makes security metrics worthy of pursuit is that of decision support, where the question being studied is one more of trajectory than exactly measured position. We are not in this for reasons of science, though those that are in it for science (or philosophy) will also want measurement of some sort to backstop their theorizing. We are in this because the scale of the task compared to the scale of our tools demand force multiplication. No game play improves without a way to keep score.
CyberGreen’s number one goal is to detect the precursors to attacks, especially to denial of service attacks; assuming that the motivation to attack will always be available, our job is to measure its opportunity. While it is true that vulnerable endpoints can be used for any bad activity, we cannot measure some kinds of bad activity so must stick to those we can measure and to the point, measure in a way that is solid decision support.
