文档介绍：PRAISE FOR SECURITY METRICS
“Throw out the security religion and make informed business decisions now!”
—Mark Curphey
ISBPM, Inc.
“Connecting People, Process and Technology”
“I’m very excited that Jaquith has written a text on metrics, and expect this will
be the standard reference for years e.”
—Adam Shostack
“Andrew devotes an innumerable amount of time and effort to helping our
profession out at . His book is wonderful, entertaining, and well
thought-out. I found myself nodding my head in agreement more than a few times.”
—Alex Hutton
CEO, Risk Management Insight
“Andrew has written a book that most people who work in information protection
and those who manage and work with them should read, not because it is particu-
larly informative about information protection, but because it is highly informative
about the challenges of measuring protection programs effectively. While lots of
books are out there about this or that aspect of security, from a security manage-
ment standpoint, you cannot manage what you cannot measure, and Andrew
puts his stake in the ground with this book about what you should measure and
how to do it.”
—Dr. Fred Cohen
CEO, Fred Cohen & Associates
/
“To paraphrase Lord Kelvin’s famous quote, ‘You cannot improve what you cannot
measure.’ Computer security has inhabited this sorry state for years, leaving too
much room for snake oil, scare tactics, and plain old bull feathers. Andy’s book
helps to remedy this problem by sending a strong clear message that metrics are both
necessary and possible. Buy this strikingly well-written book today and help put an
end to security nonsense.”
—Gary McGraw, .
CTO, Cigital
Author of Software Security: Building Security In
This page intentionally left blank
Security Metrics
Security Metrics
REPLACING FEAR,UNCERTAINTY, AND DOUBT
Andrew Jaquith
Upper Saddle River, NJ • Boston • Indianapolis • San Francisco
New York • Toronto • Mo