Zed Abbadi 

Metrics and measurements are the cornerstones of any scientific discipline. Security metrics are essential to meeting an organizations’ security objectives. Building secure systems and securing computer networks are highly dependent on quantitative measurements that define the target security levels and current, or achievable, security levels. Without good metrics, it is difficult to assert a certain level of security, or compare products or systems that claim specific security features.

Various security metrics exist that are widely used by the security community. However, most of them fall short of meeting the scientific definition of a metric. This talk will discuss these metrics, and how they relate to security testing. It will provide an overview of the current status of security metrics and discuss a number of metrics and their virtues and shortcomings.

---