{"id":7642,"date":"2021-08-17T14:00:38","date_gmt":"2021-08-17T14:00:38","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7642"},"modified":"2021-08-17T14:00:39","modified_gmt":"2021-08-17T14:00:39","slug":"measuring-success-cybersecurity-performance-metrics","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/measuring-success-cybersecurity-performance-metrics\/","title":{"rendered":"Measuring success: 14 Cybersecurity Performance Metrics That Count"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7642\" class=\"elementor elementor-7642\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">Cybersecurity never sits still. While you may have created a programme that addresses the current cyber threats towards your organisation, the chances are that it will not stay that way. New threats emerge, new techniques and technologies are put into play by cyber criminals, and employees change. You can\u2019t manage what you don\u2019t know, and that\u2019s why it is important to follow a reporting regime that includes the cybersecurity performance metrics that really tell the story of how well your cyber defences are performing.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Why measure cybersecurity performance metrics?<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">The correct set of cybersecurity performance metrics will support your cybersecurity programme, and help your organisation make the right decisions when it comes to the future of the programme. Getting the right cybersecurity performance metrics will give the full picture to the cybersecurity team and management alike, in a way that can be tracked over time.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Tracking cybersecurity performance metrics over time will give early warning when tools or controls are no longer effective, when new tools need to be considered, or when additional resources are needed. The cybersecurity performance metrics will support decisions for budgets and spending.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Tracking and reporting cybersecurity performance metrics gives your IT security team the ability to benchmark your organisation\u2019s security posture against similar organisations. This then enables the IT security team to understand how your cybersecurity fits into the bigger picture, once again supporting decision making.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Cybersecurity KPI metrics<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">In order to achieve the organisation\u2019s goals, you need to choose the right cybersecurity KPI metrics to report on a regular basis.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The list of cybersecurity performance metrics below are just some examples of the many metrics that can be used to create a balanced report that will benefit your cybersecurity programme.<\/span><\/p>\n<h3><span style=\"font-weight: 400;\">Protection metrics<\/span><\/h3>\n<p><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Protecting the network<\/span><\/a><span style=\"font-weight: 400;\"> is vital to reducing cybersecurity risks in an organisation. The following cybersecurity performance metrics measure the effectiveness of your cyber prevention programme.<\/span><\/p>\n<p><b>1 &#8211; Proportion of devices with endpoint protection<\/b><span style=\"font-weight: 400;\"> &#8211; Endpoints such as computers, servers, and printers are among the most vulnerable elements of an organisation\u2019s cybersecurity programme, in part because they are operated by another vulnerable element &#8211; human beings. A cybersecurity programme should consider endpoint protection on every device, and keep track of any endpoints that are not protected. The goal of this cybersecurity performance metric is a figure as close to 100% as possible.<\/span><\/p>\n<p><b>2 &#8211; Number of users with super user or admin rights<\/b><span style=\"font-weight: 400;\"> &#8211; Admin or super user accounts can be used in privilege escalation attacks. The principle of least privilege dictates that admin or super user rights should be given to as few people as possible in order to carry out their work. The number should be as low as possible.<\/span><\/p>\n<p><b>3 &#8211; Average time to patch vulnerabilities<\/b><span style=\"font-weight: 400;\"> &#8211; When vendors release security updates, how long does it take to update software? Delays to applying security patches leaves the organisation open to cyber attack through a known vulnerability. Best practice is to apply patches fast, and when patches are not available, to virtually patch in the interim. The goal is to apply patches quickly, within days or even hours of the update\u2019s release.<\/span><\/p>\n<p><b>4 &#8211; Number of systems with known vulnerabilities<\/b><span style=\"font-weight: 400;\"> &#8211; Some systems may have known vulnerabilities. Knowing how many systems have known vulnerabilities, and what the vulnerabilities are in each system will enable your organisation to manage risk. This cybersecurity KPI is a measure of the effectiveness of your vulnerability management programme.<\/span><\/p>\n<p><b>5 &#8211; Average vendor security rating<\/b><span style=\"font-weight: 400;\"> &#8211; <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/kaseya-ransomware-attack-update\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Supply chain attacks<\/span><\/a><span style=\"font-weight: 400;\"> are an increasing threat for organisations of all sizes. A cybersecurity programme must include third party assurance of new and existing vendors on a regular basis and continuous monitoring of their cybersecurity positions. This KPI should return high security ratings and low risk ratings for all third parties used in your organisation.<\/span><\/p>\n<p><b>6 &#8211; Cybersecurity training session results<\/b><span style=\"font-weight: 400;\"> &#8211; Employees are traditionally seen as the weakest links in organisations\u2019 cybersecurity programmes. However, employees could easily be turned into security champions through effective training. This cybersecurity performance metric will let you see who has taken and completed training, how training was delivered, and the topics that were covered. Training and reporting should include the participation of all employees from the CEO down.<\/span><\/p>\n<p><b>7 &#8211; Security policy compliance<\/b><span style=\"font-weight: 400;\"> &#8211; Security policies are only as good as the activity they refer to. A key cybersecurity KPI is how well are you performing against the expectations of security policies. Information in this KPI includes tracking and documenting exceptions, implementing configurations and compliance controls, and measuring performance against them.<\/span><\/p>\n<h3><span style=\"font-weight: 400;\">Incident metrics<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Incidents of all shapes and sizes will take place regularly. How you <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/guide-to-cyber-security-incident-response-planning\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">respond to the incident<\/span><\/a><span style=\"font-weight: 400;\"> is key to recovering quickly. Furthermore, <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/indicators-of-compromise-analysis-is-half-the-story\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">analysis of the event<\/span><\/a><span style=\"font-weight: 400;\"> will help your organisation learn for next time.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The following cybersecurity performance metrics measure the effectiveness of your cyber incident response.<\/span><\/p>\n<p><b>8 &#8211; Unidentified devices on the network<\/b><span style=\"font-weight: 400;\"> &#8211; Personal devices, visitor devices, or IoT devices on your network all increase security risks for your organisation. This cybersecurity performance metric will ask you to keep track of unidentified devices, and enforce a way to identify any unidentified devices. The aim of this is to be as close as possible to zero &#8211; IT security should be able to identify every device on the main network (not including any guest\/ external networks).<\/span><\/p>\n<p><b>9 &#8211; Mean time to detection<\/b><span style=\"font-weight: 400;\"> &#8211; The longer it takes to detect attacks, the more damage attackers can cause. <\/span><a href=\"https:\/\/www.zdnet.com\/article\/cybersecurity-organisations-are-getting-quicker-at-discovering-cyber-attacks-in-their-networks-but-theres-a-catch\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Average dwell time<\/span><\/a><span style=\"font-weight: 400;\"> has dropped to 24 days, a significant improvement from 56 days in 2020, but it is still time for attackers to cause significant damage. The aim is to get as close to zero as possible.<\/span><\/p>\n<p><b>10 &#8211; Mean time to resolution<\/b><span style=\"font-weight: 400;\"> &#8211; The longer it takes to resolve a <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/guide-to-cyber-security-incident-response-planning\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cybersecurity incident<\/span><\/a><span style=\"font-weight: 400;\"> the more it will cost your organisation in downtime, reputation, customers, and money. How long did it take to resolve incidents during the last reporting period? Is this improving? The aim of this cybersecurity performance metric is to show improvement in response times, and should be measured in hours.<\/span><\/p>\n<p><b>11 &#8211; Reported incidents<\/b><span style=\"font-weight: 400;\"> &#8211; How many cyber incidents were discovered or picked up by monitoring tools over the last period? Is the rate of incidents increasing or decreasing? What are the incidents that are being reported? This cybersecurity KPI can help your organisation understand where resources need to be directed in your cybersecurity programme.<\/span><\/p>\n<p><b>12 &#8211; Number of incidents by category<\/b><span style=\"font-weight: 400;\"> &#8211; Understanding the types of incidents that you are actually experiencing will go a long way towards informing your cybersecurity programme. This metric should list attacks in the <\/span><a href=\"https:\/\/www.gov.uk\/government\/statistics\/cyber-security-breaches-survey-2021\/cyber-security-breaches-survey-2021\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">most common cyber attacks<\/span><\/a><span style=\"font-weight: 400;\"> categories such as ransomware, phishing, DDoS, and so on.<\/span><\/p>\n<p><b>13 &#8211; Cost per incident<\/b><span style=\"font-weight: 400;\"> &#8211; Cyber incidents cost money, man hours, loss of productivity, and more. This cybersecurity performance metric will provide a picture of the resources used to clear up each incident. The aim is for this figure to be as low as possible.<\/span><\/p>\n<p><b>14 &#8211; Downtime<\/b><span style=\"font-weight: 400;\"> &#8211; When systems are down, employees can\u2019t do their work, customers can\u2019t interact with you, and orders will be unfulfilled. Downtime can be added to the cost of an incident. The goal in this cybersecurity KPI is the shorter the downtime, the better.<\/span><\/p>\n<h2><span style=\"font-weight: 400;\">Choosing the right cybersecurity performance metrics<\/span><\/h2>\n<p><span style=\"font-weight: 400;\">There isn\u2019t such a thing as a prescribed list of cybersecurity KPIs. Your cybersecurity performance metrics should support your <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/cybersecurity-risk-management\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">cybersecurity risk management programme<\/span><\/a><span style=\"font-weight: 400;\">, and give valuable insight to your management team and decision makers.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The cybersecurity performance metrics you collect and report should be able to tell the story to non-technical managers and cyber professionals alike, and demonstrate the value of investing in cybersecurity. Where possible your cybersecurity performance metrics should allow you to benchmark your organisation against industry standards.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Whichever metrics you choose, they should be an asset to your overall security.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Cybersecurity never sits still. While you may have created a programme that addresses the current cyber threats towards your organisation, the chances are that it will not stay that way. New threats emerge, new techniques and technologies are put into play by cyber criminals, and employees change. You can\u2019t manage what you don\u2019t know, and&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7650,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7642"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7642"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7642\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7650"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}