Information Security Management Metrics: A Definitive Guide to Effective Security Monitoring and Measurement (Hardcover)

Spectacular security failures continue to dominate the headlines despite huge increases in security budgets and ever-more draconian regulations. The 20/20 hindsight of audits is no longer an effective solution to security weaknesses, and the necessity for real-time strategic metrics has never been more critical.

Information Security Management Metrics: A Definitive Guide to Effective Security Monitoring and Measurement offers a radical new approach for developing and implementing security metrics essential for supporting business activities and managing information risk. This work provides anyone with security and risk management responsibilities insight into these critical security questions:

How secure is my organization?

How much security is enough?

What are the most cost-effective security solutions?

How secure is my organization?

Solid metrics are the key to cost-effective information security – you can’t manage what you can’t measure

This volume shows readers how to develop metrics that can be used across an organization to assure its information systems are functioning, secure, and supportive of the organization’s business objectives. It provides a comprehensive overview of security metrics, discusses the current state of metrics in use today, and looks at promising new developments. Later chapters explore ways to develop effective strategic and management metrics for information security governance, risk management, program implementation and management, and incident management and response.  

The book ensures that every facet of security required by an organization is linked to business objectives, and provides metrics to measure it. Case studies effectively demonstrate specific ways that metrics can be implemented across an enterprise to maximize business benefit.

With three decades of enterprise information security experience, author Krag Brotby presents a workable approach to developing and managing cost-effective enterprise information security.

儘管安全預算大幅增加且監管措施日益嚴格，但令人驚嘆的安全失敗仍然佔據著頭條新聞。審計的後見之明已不再是解決安全弱點的有效方法，實時戰略指標的必要性變得更加關鍵。《信息安全管理指標：有效安全監控和測量的明確指南》提供了一種全新的方法，用於開發和實施支持業務活動和管理信息風險所必需的安全指標。本書為擔任安全和風險管理職責的人員提供了洞察力，幫助回答以下關鍵安全問題：

- 我的組織有多安全？
- 安全程度足夠嗎？
- 最具成本效益的安全解決方案是什麼？
- 我的組織有多安全？

堅實的指標是成本效益信息安全的關鍵 - 你無法管理你無法測量的事物。本書向讀者展示如何開發可在整個組織中使用的指標，以確保其信息系統運作正常、安全且支持組織的業務目標。它全面概述了安全指標，討論了當今使用的指標現狀，並展望了有前景的新發展。後面的章節探討了如何為信息安全治理、風險管理、計劃實施和管理以及事件管理和應對開發有效的戰略和管理指標。

本書確保組織所需的每個安全方面都與業務目標相關聯，並提供了用於測量的指標。案例研究有效地展示了如何在企業中實施指標以最大化業務效益。作者Krag Brotby擁有三十年的企業信息安全經驗，提出了一種可行的方法來開發和管理成本效益的企業信息安全。