Abstract :
Although most businesses say information security is a primary concern, few have adequate systems in place because securing information requires a risk-management approach with dependable, quantifiable metrics. Simple questions, readily answered in any other business context, are met by information security experts with embarrassed silence. These questions include: Is my security better this year? What am I getting for my security dollars? How do I compare with my peers? Answering such questions requires rigorous security metrics; and a risk-management framework in which to compare them.
