ABSTRACT
No doubt some will say, “Hold on. We know what we are measuring. We measured how many people tried using invalid logons to get into our systems.”
What is that a measure of? What relevance does it have to managing, operating, or maintaining the security infrastructure? What does it mean? Is it predictive? More importantly, are we certain that no unauthorized person did in fact log on?
