Who Watches the Watchers - Metrics for Security Strategy

Explore a comprehensive conference talk on security metrics and strategy, delving into the importance of metrics in cybersecurity. Learn about automation, vulnerabilities, and the power law distribution in security. Discover vulnerability management techniques and understand what makes a metric effective or ineffective. Examine the concept of successful exploits and how to prioritize using the Common Vulnerability Scoring System (CVSS). Investigate exploitability metrics and various types of metrics used in security. Analyze the mean time to incident discovery and its limitations. Gain insights into scanning coverage and explore the most interesting metrics in the field of cybersecurity.

Intro
Metrics are useful
Automation
Vulnerabilities
Powerlaw
Vulnerability Management
What makes a metric bad
What is a successful exploit
CBSS for prioritization
CBSS for breach volume
Exploitability metrics
What defines a good metric
Types of metrics
Good metrics
Mean time to incident discovery
The problem with using the metric
Scanning coverage
Most interesting metrics