Cybersecurity

Metrics-driven Information Security Framework for Effective Information Security Management Governance

Publish Date: November 15, 2022

Measuring and reporting information security is a top priority for Information security managers. Creating metrics-based monitoring and reporting is crucial for emphasizing the importance of information security to the top management and relevant stakeholders.

All major frameworks and standards emphasize the necessity to measure and report on information security management, risks, and general operational stance and situation at the company.

However, most frameworks don’t provide actual metrics or frameworks for measuring security or the status of information security-related risks.

YASH helps organizations develop accurate metrics-based security reporting models aligning with the company’s security frameworks and compliance requirements.

The ‘right metrics’ approach:

The top reason metrics aren’t utilized effectively in information security management today is that security leaders typically fail to create a proper measurement system due to ongoing changes in the business environment.

A lot of investment is made towards improving digital security without the ability to monitor the ROI of those investments. Most of the time, KPIs have not been decided to lead to slippages.

Choosing metrics

Deciding what to measure is crucial to an effective metrics program. This should include what security policies have been created and how they are deployed. Metrics do not always need to endorse a numeric and/or tangible structure. They should be able to communicate value to stakeholders.

Without any pre-existing framework, either a top-down or a bottom-up approach for selecting metrics can be used.

The top-down approach begins with the security program’s objectives and then works backward to identify specific metrics that would indicate progress toward each goal.

The bottom-up approach starts with defining which security processes, products, etc., are in place that can be or is already being measured and then considering what meaningful metrics can be generated from those measurements. It finally evaluates how well those metrics link to the established objectives of the overall security program.

Here are a few examples of different metrics that an organization can use to assess its security posture & measure security activities associated with its infrastructure:

Malware management
Email, configuration management
Incident management
Vulnerability management
Change management
Patch management
Cyber resilience

Sample Metrics

Security Area	Metric
Business System Security	% of applications that have been subject to risk assessments at least once in the last three months
Business System Security	% of applications without any Critical or High-risk flaws/vulnerabilities
Change management	How long does it take to detect configuration changes to a system?
Change management	How long does it take to detect configuration changes to a network system?
Security Incident Management	The average time it takes to detect a security incident (MTTD)
Security Incident Management	The average time it takes to mitigate security incident (MTTR)

Conclusion

Strong security management and controls have become essential to mitigate asymmetric threats looming over businesses. Security is a multi-dimensional problem and must be viewed holistically. This can only be achieved with a cohesive approach involving the right mix of resources, processes, skillsets, and effective risk management & governance framework. YASH can help in this regard.

YASH’s Ondemand vCISO Services can help businesses build robust security metrics and capture/track them by leveraging our expertise in designing and implementing customized security roadmaps for measurable improvement to the security posture.

Leveraging the leadership of our vCISO services, information security teams, and technology CoE, we empower you to integrate a real-time approach to achieve enterprise-wide visibility. Enabling effective control and governance of your internal IT resources while enhancing your business intelligence efforts to better inform decision-making.

YASH Differentiators:

Experience in automation-led security transformation programs
Experienced CISOs backed by rich experience, having successfully delivered multiple enterprise engagements
Dedicated cyber security CoE to manage complex cyber security technologies and projects
Library of 100+ documents, tools, and framework models that have been used successfully for our customers and are ready to be implemented in your organization.

Click here to know more, or write to us at cybersecurity@yash.com.