+G-SM-1-B Define basic security metrics

G-SM-1-B Define basic security metrics

Maturity level 1 objective of the practice: Identify objectives and means of measuring effectiveness of the security program.

Benefit: Basic insights into your AppSec program's effectiveness and efficiency

Short description: Define metrics with insight into the effectiveness and efficiency of the Application Security Program.

Define and document metrics to evaluate the effectiveness and efficiency of the application security program. This way, improvements are measurable and you can use them to secure future support and funding for the program. Considering the dynamic nature of most development environments, metrics should consist of measurements in the following categories

  • Effort metrics measure the effort spent on security. For example training hours, time spent performing code reviews, and number of applications scanned for vulnerabilities.
  • Result metrics measure the results of security efforts. Examples include number of outstanding patches with security defects and number of security incidents involving application vulnerabilities.
  • Environment metrics measure the environment where security efforts take place. Examples include number of applications or lines of code as a measure of difficulty or complexity.

Each metric by itself is useful for a specific purpose, but a combination of two or three metrics together helps explain spikes in metrics trends. For example, a spike in a total number of vulnerabilities may be caused by the organization on-boarding several new applications that have not been previously exposed to the implemented application security mechanisms. Alternatively, an increase in the environment metrics without a corresponding increase in the effort or result could be an indicator of a mature and efficient security program.

While identifying metrics, it's always recommended to stick to the metrics that meet several criteria

  • Consistently Measured
  • Inexpensive to gather
  • Expressed as a cardinal number or a percentage
  • Expressed as a unit of measure

Document metrics and include descriptions of best and most efficient methods for gathering data, as well as recommended methods for combining individual measures into meaningful metrics. For example, a number of applications and a total number of defects across all applications may not be useful by themselves but, when combined as a number of outstanding high-severity defects per application, they provide a more actionable metric.

1. Prehľad

1.1 Odkazy

1.2 Identifikované požiadavky

1.3 Súvisiace predpisy

2. Identifikované požiadavky

Požiadavky

3. Súvisiace predpisy

Predpisy

Prepojené úlohy

Prepojenia
is blocked by G-SM-1-B Do you use a set of metrics to measure the effectiveness and efficiency of the application security program across applications?
  • OWASP -

    EN: Publications of the OWASP Foundation, https://owasp.org/. OWASP® is a registered trademark of the OWASP Foundation, Inc.; GRCA is not affiliated with, nor endorsed by, the OWASP Foundation. Only the versions published by OWASP are authoritative.

    DE: Veröffentlichungen der OWASP Foundation, https://owasp.org/. OWASP® ist eine eingetragene Marke der OWASP Foundation, Inc.; GRCA steht in keiner Verbindung zur OWASP Foundation und wird von ihr nicht unterstützt. Maßgeblich sind allein die von OWASP veröffentlichten Fassungen.