Who Watches the Watchers? Metric for Security Strategy

Explore the critical role of metrics in cybersecurity strategy through this 55-minute conference talk from BSidesLV 2015. Delve into the importance of effective metrics, automation in vulnerability management, and the characteristics of good and bad security metrics. Examine real-world examples like Heartbleed and CVSS, analyze breach volume trends, and understand attacker tactics. Engage in thought exercises to develop better metrics, learn about different types of security measurements, and critically evaluate common metrics such as Mean Time to Incident Discovery. Gain insights into vulnerability metrics and discover the most interesting and valuable metrics for improving overall security posture.

Introduction
Metrics are useful
Automation
Vulnerabilities
Vulnerability Trend
Vulnerability Management
Bad Metrics
Metrics are Decision Support
What Makes a Metric Good
What Makes a Metric Bad
Heartbleed
CBSS
Breach Volume
Attacker Tactics
Thought Exercise
Types of Metrics
What Makes a Good Metric
Mean Time to Incident Discovery
The Problem with the Metric
Vulnerability Metrics
Most Interesting Metrics