Security Metrics: Replacing Fear, Uncertainty, and Doubt

Andrew Jaquith

  • 出版商: Addison Wesley
  • 出版日期: 2007-03-01
  • 售價: $2,620
  • 貴賓價: 9.5$2,489
  • 語言: 英文
  • 頁數: 336
  • 裝訂: Paperback
  • ISBN: 0321349989
  • ISBN-13: 9780321349989
  • 相關分類: 資訊安全
  • 海外代購書籍(需單獨結帳)

買這商品的人也買了...

商品描述

Description

The Definitive Guide to Quantifying, Classifying, and Measuring Enterprise IT Security Operations

 

Security Metrics is the first comprehensive best-practice guide to defining, creating, and utilizing security metrics in the enterprise.

 

Using sample charts, graphics, case studies, and war stories, Yankee Group Security Expert Andrew Jaquith demonstrates exactly how to establish effective metrics based on your organization’s unique requirements. You’ll discover how to quantify hard-to-measure security activities, compile and analyze all relevant data, identify strengths and weaknesses, set cost-effective priorities for improvement, and craft compelling messages for senior management.

 

Security Metrics successfully bridges management’s quantitative viewpoint with the nuts-and-bolts approach typically taken by security professionals. It brings together expert solutions drawn from Jaquith’s extensive consulting work in the software, aerospace, and financial services industries, including new metrics presented nowhere else. You’ll learn how to:

 

• Replace nonstop crisis response with a systematic approach to security improvement

• Understand the differences between “good” and “bad” metrics

• Measure coverage and control, vulnerability management, password quality, patch latency, benchmark scoring, and business-adjusted risk

• Quantify the effectiveness of security acquisition, implementation, and other program activities

• Organize, aggregate, and analyze your data to bring out key insights

• Use visualization to understand and communicate security issues more clearly

• Capture valuable data from firewalls and antivirus logs, third-party auditor reports, and other resources

• Implement balanced scorecards that present compact, holistic views of organizational security effectiveness

 

Whether you’re an engineer or consultant responsible for security and reporting to management–or an executive who needs better information for decision-making–Security Metrics is the resource you have been searching for.

 

 

Table of Contents

Foreword           xv

Preface             xix

Acknowledgments          xxv

About the Author            xxviii

Chapter 1     Introduction: Escaping the Hamster Wheel of Pain         1

Chapter 2     Defining Security Metrics         9

Chapter 3     Diagnosing Problems and Measuring Technical Security            39

Chapter 4     Measuring Program Effectiveness         89

Chapter 5     Analysis Techniques   133

Chapter 6     Visualization   157

Chapter 7     Automating Metrics Calculations          217

Chapter 8     Designing Security Scorecards            251

Index    301

商品描述(中文翻譯)

描述

《安全指標》是第一本全面的最佳實踐指南,用於定義、創建和利用企業安全指標。作者安德魯·雅奎斯基於您組織的獨特需求,使用樣本圖表、圖形、案例研究和實例,展示了如何建立有效的指標。您將學習如何量化難以衡量的安全活動,編制和分析所有相關數據,確定優勢和劣勢,為改進設定具有成本效益的優先順序,並為高級管理層製作引人入勝的信息。

《安全指標》成功地將管理層的定量觀點與安全專業人員通常採取的實用方法相結合。它匯集了雅奎斯基在軟件、航空航天和金融服務行業的廣泛咨詢工作中提供的專家解決方案,包括其他地方未提供的新指標。您將學習如何:

- 用系統方法取代不斷的危機應對,改進安全性
- 理解“好”和“壞”指標之間的差異
- 測量覆蓋範圍和控制、漏洞管理、密碼質量、補丁延遲、基準評分和業務調整風險
- 量化安全採購、實施和其他計劃活動的效果
- 組織、匯總和分析數據以獲得關鍵見解
- 使用可視化更清晰地理解和傳達安全問題
- 從防火牆和防病毒日誌、第三方審計師報告和其他資源中獲取有價值的數據
- 實施平衡計分卡,提供組織安全效能的簡潔、全面的視圖

無論您是負責安全和向管理層報告的工程師或顧問,還是需要更好的信息來做出決策的高級管理人員,《安全指標》都是您一直在尋找的資源。

目錄

前言