- 12 myths about how the Internet works
- Smartphone smackdown: Storm vs. iPhone
- IETF: Should we ignore the Kaminsky bug?
- Top 10 wicked cool algorithms
- How to recession-proof yourself
The Center for Information Security (CIS) is set to release guidelines for how enterprises can measure the state of their organization's security and launch a service for companies to compare their performance with their peers.
The latest CIS project is aimed at resolving the confusion and lack of uniformity in ways to measure whether an enterprise or organization's IT security is improving or not, said Bert Miuccio, CIS's CEO.
"The problem that we've come to recognize is that information security professionals really are growing more confused on how to define success," Miuccio said. "They know that compliance with regulatory requirements and audit frameworks do not necessarily result in improved security and are not the best measures of success."
CIS is a nonprofit organization funded by enterprises and other organizations with an interest in security. Since it was formed in 2000, it has created 40 benchmarks for default security configurations for software ranging from operating systems to middleware to network devices. The benchmarks, which are a free download on the CIS Web site, are intended to help organizations reduce IT security risks.
Every security professional has different definitions for how to evaluate security measures, Miuccio said. CIS has assembled 85 information security experts to agree upon methods to measure eight different metrics. The metrics should be released in late October or early November, Miuccio said.
Two are "outcome" metrics: the mean time between security incidents and the mean time to recover from security incidents. The remaining six are related to process: the percentage of systems configured to approved standards; the percentage of systems patched to policy; percentage of systems with antivirus technology; percentage of business applications that has a risk assessment; percentage of business applications that has a penetration or vulnerability assessment; and percentage of application code that has a security assessment or code review before deployment.
Along with the metrics, CIS plans to launch around the same time a software-based service for companies to compare how they are doing, in terms of security, against other anonymous companies in their market vertical. This type of comparison is already commonly used for financial results and other aspects of business performance such as customer service.
Rss FeedRss Feed
| NetworkWorld, Inc. | About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW |
| IDG, Inc. | CIO | Computerworld | CSO | Demo | GamePro | Games.net | IDGconnect.com | IDG World Expo | Infoworld | JavaWorld.com | LinuxWorld.com | MacUser | Macworld | PC World | Playlistmag.com | The Industry Standard | IDG List Services | IDG TechNetwork |
 The Leader in Network Knowledge© 1994-2008 Network World, Inc. All rights reserved. |
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comment