文档介绍：PROTECTING BUSINESS INFORMATION
fåÑçêã~íáçå=pÉÅìêáíó=jÉíêáÅë
péÉÅá~ä=fåíÉêÉëí=dêçìé
j~ó=OMMS
This document is confidential and purely for
the attention of and use anisations that are
Members of the Information Security Forum (ISF).
If you are not a Member of the ISF or have
WARNING received this document in error, please destroy it or
contact the ISF on isfinfo@ or on
+44 (0)20 7213 1745.
Any storage or use of this document anisations
which are not Members of the ISF is not permitted
and strictly prohibited.
This document has been produced with care and to the best of our ability.
However, the Information Security Forum and Information Security Forum
Limited accepts no responsibility for any problems or incidents arising from
its use.
PROTECTING BUSINESS INFORMATION
Table of contents
Part 1 Introduction
This report 1
Purpose of this report 1
Who should read this report 1
Basis for this report 2
Member-contributed material 2
Previous ISF work on security metrics 3
Part 2 A definition of security metrics
Overview 4
What are security metrics? 4
Characteristics of security metrics 6
Usage of security metrics 7
Part 3 Member usage of security metrics
Overview 8
A model for understanding security metrics 8
Why security metrics are used 9
What security metrics are used 10
How security metrics are used 12
Understanding the issues 14
Part 4 Security metrics: main issues
Overview 15
Why security metrics are used: issues 16
What is currently used and collected: issues 17
How security metrics are used: issues 18
Addressing the issues 19
Table of contents (continued)
Part 5 Security metrics: key actions
Overview 20
Key actions 20
A: Define requirements 21
B: Identify relevant security metrics 23
C: Collect data required 24
D: Produce security metrics 26
E: Prepare presentations 27
F: Use dashboards and/or scorecards 29
G: Review the use of security metrics 31
Relating the act