Questions tagged [metrics]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
1answer
80 views

Gather system metrics securely from infected VM

I intend to train an RNN on snapshots of the VM metrics to classify malware. I will, therefore, run hundreds of different pieces of malware inside that VM. It has been isolated from my host (as best ...
2
votes
2answers
147 views

Why can't a Tor node simultaneously be a guard and an exit node?

By looking at probability graphs for nodes at metrics.torproject.org, it seems that exit nodes can't also be guards (they have 0.0000% probability of serving as guard) and vice versa. Why is that so?
3
votes
2answers
247 views

How do I measure compliance to Information security policies?

I work in an organisation with 3 levels as far as information security is concerned. I'm sitting at level two where we develop policies and also assist with the standards. One of the most difficult ...
1
vote
0answers
134 views

Quantifying security with metrics

I am working on a state-of-the-art quantification of security, meaning a numerical assessment of security for a system. In my research, most of the work is not recent (up to 2012 so far) and is ...
0
votes
3answers
467 views

What are some metrics to be used to evaluate SaaS security?

What are some metrics to be used to evaluate a SaaS app's security? Some examples: static code analysis (Fortify) code coverage (bugs being a potential source of vulnerabilities) others? In case it ...
5
votes
2answers
3k views

“Triage an incident”

I have been trying to find a definition of triage in relation to Information Security but cannot find any online. From the different examples given online (i.e. medical world), it seems related to ...
1
vote
1answer
115 views

why don't we measure the strength of crypto against the cost it would take to crack it? [closed]

I hear all the time how many hours it would take to break a certain type of encryption. I think this may be the wrong metric to look at ever since scaling became an easy to implement solution. Sure ...
3
votes
2answers
589 views

security metrics on softwares developed

Thinking about software security metrics currently I've thought about the following software security metrics: number/type of CWE detected by developers (bug reporting) number/type of CWE detected by ...
5
votes
1answer
865 views

Can OSSTMM RAVs be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000?

The calculation of RAVs in OSSTMM seem very useful as a security metric but, can they be the base for a risk assessment methodology compliant with the new ISO 27001:2013 and ISO 31000? ISO 27001:2013 ...
0
votes
1answer
757 views

Main factors that influence information security effectiveness? [closed]

What are the main factors that influence information security effectiveness (besides top management support, employee training and use of security policies)?
4
votes
3answers
645 views

security performance criteria in employee reviews

Have any of you security professionals been able to get security performance metrics into reviews that managers conduct for their employees? If so, are there any helpful resources you could share to ...
8
votes
4answers
1k views

How to estimate the cost of an application vulnerability?

I've seen data on the cost of a breach including lot of surveys and research by Verizon and the Ponemon Institute. But in terms of an actual vulnerability, what are the factors to consider to ...
2
votes
2answers
315 views

What fraction of software bugs are vulnerabilities?

What fraction of software bugs are security vulnerabilities? Obviously, software bugs can be security vulnerabilities -- but also obviously, many software bugs have little or no security impact. Is ...
-1
votes
1answer
104 views

Security comparisons between two approaches: how to distinguish FUD from Substance? [closed]

Background: WorkerB and Tymac were discussing the pros-and-cons of using two different alternatives for extending a web content management system that is used in their company. Alternative one ...
3
votes
2answers
220 views

Commonly observed attack patterns modelled in Honeypot configurations

(Judging by voting and answers, I failed rather badly at asking a question that in my head was superbly clear. Clearly I was wrong. I've since attempted to rephrase the original question to more ...
8
votes
2answers
6k views

Google Analytics on a secured site

Just read this article on Google Analytics and the risk of forged certificates, where it said: Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
6
votes
2answers
3k views

Annual Rate of Occurrence (ARO) and Exposure Factor (EF) Data

I'm calculating loss expectancy (SLE/ALE) but where or how does one get data on annual rates of occurrences for various things? From simple hard-drive failure rates to something complex like the ...
14
votes
4answers
791 views

How do you estimate the costs of a security breach?

I'm a student and fairly new to the IT security field. Most articles and books say you should only patch a vulnerability if the costs of a breach are higher than the costs of patching the ...
7
votes
2answers
566 views

What key metrics should a CIO rely on to gauge the extent of IT risk exposure?

Note - This was originally asked in another Area51 proposal, which has since been deleted.