"If you can’t measure it, you can’t manage it". ( Peter Drucker)

As organizations continue to invest in security at technical and managerial levels, it is imperative to monitor and measure the effectiveness of such security programs to legitimately assure the effectiveness of the security programs. There are identifiable attributes that characterize the security of the organization. Security metrics is therefore a quantitative measure of  such attribute an organization possesses.

Metrics can be an effective tool for security managers. They can determine the effectiveness of various components of their security programs, the security of a specific system, product or process. The security managers  can also measure the ability of the staff or departments within an organization to address security issues for which they are responsible. Security Metrics can also help identify the various levels of risk and therefore provide guidance in prioritizing corrective actions. Additionally, metrics may be used to raise the level of security awareness and continue to measure its progress within the organization. Finally, with the knowledge gained through metrics, security managers can better answer hard questions from their executives and others, such as:

Security Metrics can be effectively used by adopting the process based approach. Depending upon the objectives of each process and its information security needs, it is assigned Security Metrics that can be periodically measured against the security requirements to assess the security level of the process. The security requirements can also be revised to cause improvements that again can also be measured or monitored through metrics.