# Diagnosing Problems and Measuring Technical Security

Using Metrics to Diagnose Problems: A Case Study 41
Defining Diagnostic Metrics 44
Perimeter Security and Threats 46
	E-mail 49
	Antivirus and Antispam 50
	Firewall and Network Perimeter 50
	Attacks 51
Coverage and Control 52
	Antivirus and Antispyware 58
	Patch Management 59
	Host Configuration 62
	Vulnerability Management 65
Availability and Reliability 68
	Uptime 69
	System Recovery 71
	Change Control 72
Application Security 73
	Black-Box Defect Metrics 75
	Qualitative Process Metrics and Indices 77
	Code Security Metrics 83
Summary


In security, metrics help organizations:
- Understand security risks
- Spot emerging problems
- Understand weaknesses in their security infrastructures
- Measure performance of countermeasure processes
- Recommend technology and process improvements

## Defining Diagnostic Metrics

Diagnostic metrics are used to assess security posture, diagnose issues, and measure security activities associated with infrastructure.

This chapter focuses on technical metrics that quantify each of the following:
- Perimeter defenses
- Coverage and control
- Availability and reliability
- Application risks

A large number of organizations and industry initiatives have begun creating metrics lists, notably the Corporate Information Security Working Group (CISWG), NIST, ISSEA, US CERT, and my own initiative, securitymetrics.org.