Cybersecurity has become one of the most important topics of discussion in the corporate world, with tech-savvy boards investing millions into cybersecurity solutions and products to protect their corporate assets. With cybersecurity becoming a C-level issue and a business concern instead of a technical one, CISOs can command higher budgets and invest more time and effort into implementing security frameworks; however, this also means that the board wants to see a return on their security investment. This is where cybersecurity metrics come into play.
The 6 C’s of Cybersecurity
A cybersecurity metric is something quantifiable that allows you to monitor the performance of your cybersecurity program. Creating and tracking these metrics provides the CISO and the board with relevant insights into how well their security program is performing and whether the implemented controls are working. However, these metrics do not exist in a vacuum. They form one part of an overall cybersecurity framework that should ideally consist of the “6 C’s”, foundational principles that lead to effective cybersecurity management:
-
Culture: A security culture is intangible and something that no security product can track or replicate. It is only created with practical training and awareness and must be cultivated over time. No technical control can compete with a well-trained and security-aware workforce.
-
Compliance: Companies must comply with various regulations and mandates specific to their industry, such as PCI DSS, HIPAA, and GDPR. They may also be required to comply with their clients or adhere to regulations passed down from their customers. Implementing these frameworks provides a solid foundation and helps prevent regulatory and contractual violations.
-
Controls: Security controls do not consist solely of technical controls, but form part of a larger defense-in-depth strategy that includes technical, administrative, and physical controls. All of them work together to create a practical cybersecurity framework.
-
Continuous monitoring: To know whether the controls are working, you must regularly monitor and track the security posture of your network, applications, and systems.
-
Collaboration: Sharing threat intelligence is a critical need in today’s world, given the increasing number of attacks and threat actors. By collaborating with agencies, industry experts, and law enforcement, companies can stay aware of new threats and adjust their defenses promptly.
-
Competition: More and more customer contracts are incorporating cybersecurity requirements. Having a well-developed and mature cybersecurity program will set you apart from competitors that lack a solid program or have one that has been compromised.
Introducing Cybersecurity Metrics
Cybersecurity metrics enable you to monitor the performance of a cybersecurity program valuable insights. A common misconception is that these metrics are solely technical, but as demonstrated by the 6 C’s, a cybersecurity program is more than just technical controls—and metrics are no different. They can broadly be categorized into the following categories:
-
Operational: These metrics track operational and tactical activities, such as the status of a vulnerability management program and incident response times. CISOs can ascertain whether day-to-day security tasks are optimized by tracking these tactical metrics.
-
Strategic: These metrics are high-level and focus on whether the cybersecurity program’s overall strategic aspects are practical, such as cybersecurity budget utilization or the number of locations covered within the scope of a certification like ISO 27001. By tracking these metrics, the CISO and the board can make informed, longer-term decisions about cybersecurity projects.
-
Compliance metrics: As the name implies, compliance metrics focus on the effectiveness of compliance-related initiatives (for instance, the number of assets compliant with PCI DSS requirements, or the percentage of systems that are out of compliance). These are essential for tracking the potential risks of non-compliance with industry regulations in your environment.
Metrics can also fall into Key Performance Indicators (KPIs) or Key Risk Indicators (KRIs) within the context of cybersecurity. KPI metrics focus more on performance and inform the CISO whether the cybersecurity program is meeting its goals. An example of a KPI metric would be the number of employees who have been trained or the number of incidents that are occurring. On the other hand, KRI informs the CISO about the potential risk of cybersecurity attacks and incidents, such as the number of unpatched vulnerabilities or the number of open findings from a security penetration test.
What Makes a Good Cybersecurity Metric
Good security metrics must have specific attributes to provide value; otherwise, we would waste time in tracking a measure that gives no indication about how good our cybersecurity posture is. Some of the features of a good cybersecurity metric are:
-
Relevancy: The metric pertains to your company’s business model and technical profile. A company with no online presence that regularly tracks DDOS attacks might not be relevant and provide no value.
-
Quantifiability: Being quantifiable makes it easier to identify and analyze whether a metric is performing or not. For example, the time taken to respond to an incident can be tracked in hours or days, showing whether the improvement is happening over time.
-
Simplicity: Metrics do not have to be complex or especially technical. The simpler the metric, the easier it will be to communicate to a broader audience of stakeholders and get further buy-in for the cybersecurity program.
-
Actionability: The metric should lend itself to taking tangible action and decisions based on the information it provides. For example, if the time-to-response metric is increasing, the incident response process may have bottlenecks that need to be addressed.
-
Timeliness: The metric should be real-time or nearly so, allowing the CISO to adjust and refine controls as needed.
Top 5 Cybersecurity Metrics Your Business Should Track
Having reviewed what makes a good cybersecurity metric, let’s go over some of the critical metrics every business should keep in mind to maintain an adequate cybersecurity posture:
-
Patch and vulnerability management: Monitoring the effectiveness of patched vs. unpatched systems is a crucial metric for assessing an environment’s security. An unpatched or vulnerable system can be the doorway through which an attacker enters a network. This makes it a key metric to track regularly. Monitoring the duration between a reported vulnerability and its mitigation is also essential. A low average patch time indicates a mature and responsive security operations team.
-
Time to detect and respond: Security incidents are inevitable; thus, monitoring the effectiveness of the environment’s incident response is essential. The time window between incident detection and response should be as short as possible. Monitoring this metric will enable the identification of bottlenecks and areas of improvement. Automating parts of the response process and ensuring playbooks are in place can significantly reduce these timelines.
-
Security awareness levels: Most companies have awareness programs in place, but few bother to monitor their effectiveness over time. This can be done via assessments, completion rates, and knowledge checks, and reported as a percentage of the total workforce. A well-trained employee can be the difference between a crippling cyberattack and a successful defense. Tracking phishing simulation results over time can also help determine the program’s impact and highlight areas where additional training may be required.
-
Number and type of security incidents: A key metric to monitor is the number and type of incidents that occur over time. Security incidents come in various forms, such as ransomware, DDoS attacks, social engineering, web application attacks, and more. This metric will enable you to identify which controls require more fine-tuning. This can also be used to justify investment in security tooling based on the number of high-risk incidents occurring. Trending this data quarterly can reveal if your overall security posture is improving or regressing.
-
The financial impact of security incidents: A critical strategic metric is the estimated or potential financial impact of security incidents. This is essential for monitoring the organization’s exposure to security incidents, including regulatory fines, data loss, downtime, etc., comparable to the previous metric. Monitoring these areas will enable CISOs to identify which areas have the most significant impact on a company and justify their security spending. Clear financial quantification also makes cybersecurity more relatable to executive leadership and board members.
Conclusion
For a security program to be effective, it must be monitored and have metrics in place. Cybersecurity metrics, provided they meet the criteria listed above, can be invaluable for tracking the performance of your security program and providing an objective measure of its effectiveness. By incorporating best practices and metrics, CISOs can proactively identify which areas to focus on and improve over time. Furthermore, well-defined metrics help align security initiatives with business goals, justify investments in cybersecurity, and foster a culture of accountability and continuous improvement throughout the organization.
