The right data–used in the right way–can be crucial to making effective business decisions. Gathering the wrong metrics, or gathering too much data with no intelligent way to separate important or actionable information from trivial data can be devastating.
Metrics are an important element of making effective business decisions. When it comes to security, metrics can help you determine the performance of current security tools and processes, and identify weaknesses or areas to be improved. Security metrics can also help you identify and thwart an ongoing attack against your network or data.
That assumes, however, that you’re looking at the right metrics and acting on the information appropriately.
Wrong Metrics Yield Wrong Results
Consider the Titanic, and let’s assume for a minute that metric data was being collected and reported, ostensibly to ensure the ship safely navigates through a sea of icebergs. How valuable would it be for the captain to receive a report detailing the number of deck chairs on the ship, along with how many of them were damaged and in need of repair? Zero.
Organizations need to have tools and processes in place that allow them to capture and analyze the right information. From a security perspective, it helps to work backward. Consider what a successful attack looks like, and the events and activities that lead up to it. That way you can identify the appropriate indicators of compromise that should trigger an immediate response.
Right Metrics, Wrong Process
Let’s go back to our Titanic example. It would obviously have been much more valuable for the captain of the Titanic to receive a report detailing the icebergs that had been identified in the path of the ship, along with a series of recommendations for how to adjust navigation to avoid them. If the captain did not regularly view the metrics reports, though, and if there was no process in place to separate important information about icebergs from irrelevant information like the number of deck chairs, the results would be the same.
Another example of having the right information with the wrong process was the data breach of US retail chain Target in late 2013. A 2014 article explains, “Target confirmed Friday that the hack attack against the retailer’s point-of-sale (POS) systems that began in late November triggered alarms, which its information security team evaluated and chose to ignore.”
In other words, Target had the right security in place, and the tools to generate the alerts necessary to make security personnel aware that a critical event was happening, but the process for differentiating critical alerts from trivial alerts and responding appropriately to that information was flawed.
Read the full story on the Tenable blog: Use the Right Security Metrics in the Right Way.
- Ransomware-Proof Your Data Backups with Immutability - April 10, 2024
- Unearthing Identity Threat Exposures - April 1, 2024
- Future of Tech and Cybersecurity Looks Bright Thanks to AI - March 26, 2024
i dont think this described the titanic sinking