G-SM-B Stream B: Measure and Improve

Maturity level 1 objective of the practice: Identify objectives and means of measuring effectiveness of the security program.

Benefit: Basic insights into your AppSec program's effectiveness and efficiency

Short description: Define metrics with insight into the effectiveness and efficiency of the Application Security Program.

Define and document metrics to evaluate the effectiveness and efficiency of the application security program. This way, improvements are measurable and you can use them to secure future support and funding for the program. Considering the dynamic nature of most development environments, metrics should consist of measurements in the following categories

• Effort metrics measure the effort spent on security. For example training hours, time spent performing code reviews, and number of applications scanned for vulnerabilities.
• Result metrics measure the results of security efforts. Examples include number of outstanding patches with security defects and number of security incidents involving application vulnerabilities.
• Environment metrics measure the environment where security efforts take place. Examples include number of applications or lines of code as a measure of difficulty or complexity.

Each metric by itself is useful for a specific purpose, but a combination of two or three metrics together helps explain spikes in metrics trends. For example, a spike in a total number of vulnerabilities may be caused by the organization on-boarding several new applications that have not been previously exposed to the implemented application security mechanisms. Alternatively, an increase in the environment metrics without a corresponding increase in the effort or result could be an indicator of a mature and efficient security program.

While identifying metrics, it's always recommended to stick to the metrics that meet several criteria

• Consistently Measured
• Inexpensive to gather
• Expressed as a cardinal number or a percentage
• Expressed as a unit of measure

Document metrics and include descriptions of best and most efficient methods for gathering data, as well as recommended methods for combining individual measures into meaningful metrics. For example, a number of applications and a total number of defects across all applications may not be useful by themselves but, when combined as a number of outstanding high-severity defects per application, they provide a more actionable metric.

Maturity level 2 objective of the practice: Establish a unified strategic roadmap for software security within the organization.

Benefit: Transparency on your AppSec program's performance

Short description: Set targets and KPI's for measuring the program effectiveness.

Once the organization has defined its application security metrics, collect enough information to establish realistic goals. Test identified metrics to ensure you can gather data consistently and efficiently over a short period. After the initial testing period, the organization should have enough information to commit to goals and objectives expressed through Key Performance Indicators (KPIs).

While several measurements are useful for monitoring the information security program and its effectiveness, KPIs consist of the most meaningful and effective metrics. Aim to remove volatility common in application development environments from KPIs to reduce the chances of unfavorable numbers resulting from temporary or misleading individual measurements. Base KPIs on metrics considered valuable not only to Information Security professionals but also to individuals responsible for the overall success of the application, and the organization's leadership. View KPIs as definitive indicators of the success of the whole program and consider them actionable.

Fully document KPIs and distribute them to the teams contributing to the success of the program as well as the organization's leadership. Ideally, include a brief explanation of the information sources for each KPI and the meaning when the numbers are high or low. Include short and long-term goals, and ranges for unacceptable measurements requiring immediate intervention. Share action plans with application security and application development teams to ensure full transparency in understanding of the organization's objectives and goals.

Maturity level 3 objective of the practice: Align security efforts with the relevant organizational indicators and asset values.

Benefit: Continuous improvement of your program according to results

Short description: Influence the strategy based on the metrics and organizational needs.

Define guidelines for influencing the Application Security program based on the KPIs and other application security metrics. These guidelines combine the maturity of the application development process and procedures with different metrics to make the program more efficient. The following examples show a relationship between measurements and ways of evolving and improving application security:

• Focus on maturity of the development lifecycle makes the relative cost per defect lower by applying security proactively.
• Monitoring the balance between effort, result, and environment metrics improves the program's efficiency and justifies additional automation and other methods for improving the overall application security baselines.
• Individual Security Practices could provide indicators of success or failure of individual application security initiatives.
• Effort metrics help ensure application security work is directed at the more relevant and important technologies and disciplines.

When defining the overall metrics strategy, keep the end-goal in mind and define what decisions can be made as a result of changes in KPIs and metrics as soon as possible, to help guide development of metrics.