ABSTRACT
Indeed, Andrew Jaquith of the Yankee Group expressed it well at the Metricon 1 metrics conference in 2006 during a keynote speech:
Security is one of the few areas of management that does not possess a well-understood canon of techniques for measurement. In logistics, for example, metrics like “freight cost per mile” and “inventory warehouse turns” help operators understand how efficiently trucking fleets and warehouses run. In finance, “value at risk” techniques calculate the amount of money a firm could lose on a given day based on historical pricing volatilities. By contrast, in security … there is exactly nothing. No consensus on key indicators for security exists.1
