Related Stories

  • FISMA metrics beef up active cybersecurity monitoring
    The Department of Homeland Security has released Federal Information Security Management Act (FISMA) implementation metrics for civilian federal agencies that focus on automating information system monitoring and security controls.

Top 5 Stories


Drowning in data: Security professionals look to metrics for a lifeline

10 May 2012

Security professionals are experiencing an information overload and want better metrics to analyze the data so they can take action, according to a survey conducted by Dimensional Research on behalf of RedSeal Networks.

Close to three-quarters of security researchers said that the volume of data they have to deal with makes it hard to filter, analyze, and assess changes in risk; 46% said that their security tools fail to provide data with metrics to make the information actionable; and 41% said they do not have a real-time view of their security standing.

For the survey, Dimensional Research polled 772 security professional who attended the 2012 RSA Security Conference in San Francisco.

The survey found that 81% of respondents believe security tools with improved metrics would increase overall security effectiveness.

“We are drowning in details; we have mountains of facts but very little useful information”, observed Mike Lloyd, chief technology officer with RedSeal Networks. “People agree that the right way to deal with this is using metrics”, he told Infosecurity.

Lloyd noted that this concern for metrics is shared by commercial and government security professionals. According to a survey that RedSeal sponsored last year, 64% of federal security experts said that security metrics and continuous monitoring will improve overall security, while 43% said that network security device configuration and audit tools will improve security effectiveness and meet federal mandates.

For the federal survey, Dimension Research polled over 200 federal security experts attending the 2011 GFIRST National Conference. The survey also found that only 28% of respondents expect their agency to have in place tools and process to meet the Federal Information Security Management Act (FISMA) mandate to implement continuous monitoring by the end of fiscal year 2012. More than half of respondents said that their agencies will not be ready or they did not know if their agencies would be ready to meet the continuous monitoring deadline.

“What the surveys have in common, in the public space and commercial space, is that there is a distinct hunger out there; even after years of talking about this issue, people are still struggling to find the right metrics solution”, Lloyd observed.

He opined that current security metrics are “busyness metrics, not business metrics….we end up measuring how fast the treadmill is running.”

To address the need for better metrics, RedSeal has come out with a product, RedSeal 5, which provides actionable security performance metrics and proactive intelligence to measure the impact of changes to network security controls on a continuous basis.

RedSeal 5 provides security performance reporting and metrics functionality, such as performance indicators regarding protection of critical business assets; intelligence and visibility into the current state of network security controls, validated remediation efficiency, and ongoing policy compliance; and quantitative verification of existing security controls and processes.

“What we are offering is analytics on data that organizations already have in their silos….We look at all of the data together and say, ‘Where are the weak spots in your defenses?’ We prioritize ideas based on what you can do to improve the defenses”, Lloyd concluded.

This article is featured in:
Internet and Network Security  •  IT Forensics  •  Public Sector


Comment on this article

You must be registered and logged in to leave a comment about this article.

We use cookies to operate this website and to improve its usability. Full details of what cookies are, why we use them and how you can manage them can be found by reading our Privacy & Cookies page. Please note that by using this site you are consenting to the use of cookies. ×