Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

Security Metrics: Replacing Fear, Uncertainty, and Doubt -- Chapter 3, Application Security Metrics

Measuring the security of application code is difficult. Although definitions vary, there are at least three potential ways to gather such metrics: by counting remotely and locally exploitable flaws without knowledge of the code, by counting design and implementation flaws in the code, and by creating qualitative risk indices using a weighted scoring system. Andrew Jaquith reviews them in this book excerpt.

As a registered member of SearchAppSecurity.com, you're entitled to a complimentary excerpt from Security Metrics:...

Replacing Fear, Uncertainty, and Doubt written by Andrew Jaquith and published by Addison Wesley Professional. This excerpt specifically addresses application security metrics. Jaquith discusses how to measure the security of an application and outlines three methods: by counting remotely and locally exploitable flaws without knowledge of the code (black-box metrics), by counting design and implementation flaws in the code (code security metrics) and by creating qualitative risk indices using a weighted scoring system (qualitative process metrics and indices).


Security Metrics

Book description:
Security Metrics is the first comprehensive best-practice guide to defining, creating and utilizing security metrics in the enterprise.

Using sample charts, graphics, case studies and war stories, Yankee Group Security Expert Andrew Jaquith demonstrates exactly how to establish effective metrics based on your organization's unique requirements. You'll discover how to quantify hard-to-measure security activities, compile and analyze all relevant data, identify strengths and weaknesses, set cost-effective priorities for improvement and craft compelling messages for senior management.

Security Metrics successfully bridges management's quantitative viewpoint with the nuts-and-bolts approach typically taken by security professionals. It brings together expert solutions drawn from Jaquith's extensive consulting work in the software, aerospace, and financial services industries, including new metrics presented nowhere else. You'll learn how to do the following:


  • Replace nonstop crisis response with a systematic approach to security improvement
  • Understand the differences between "good" and "bad" metrics
  • Measure coverage and control, vulnerability management, password quality, patch latency, benchmark scoring, and business-adjusted risk
  • Quantify the effectiveness of security acquisition, implementation, and other program activities
  • Organize, aggregate, and analyze your data to bring out key insights

>> Read the excerpt on application security metrics.

>> Buy the book



This was last published in April 2007

Dig Deeper on Software ROI and Business Analysis

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.