SECURITY METRICS MANAGEMENT

Transcription

1 SECURITY METRICS MANAGEMENT Presenters: Ray Bernard, PSP Bernard J. Scaglione, CPP September 26, 2007 The Basics of Security Metrics Management The Corporate Management and Shareholder View of Security Managing Costs While Improving Security 1

2 What to measure? Costs only meaningful when related to benefits Benefits only exist if security is effective Effectiveness not just security measures but security program Efficiency costs in terms of dollars, personnel, schedule Needs the risk picture Why measure? Costs must be controlled because resources are not unlimited Benefits justify costs Effectiveness to ensure benefits are obtained Efficiency to ensure maximum benefit from limited resources Needs to enable prioritization of resource use 2

3 Typical Findings Over Time: Costs increase Benefits awareness of benefits fades Effectiveness declines Efficiency is rarely considered in day to day coping Needs risk information becomes outdated They are not measured and managed on an ongoing basis. WHY? Project vs. Process Security implemented as an ongoing process can: Manage Costs Keep Stakeholders Aware of Benefits (job and budget security) Improve Effectiveness (i.e. improve security picture) Improve Efficiency (reduce stress and counter burn-out) Respond to Changing Needs (assets change, risks change) The best security programs include continuous process improvement (CPI). 3

4 More Findings Management often finds Security to be: Unaccountable for costs and results Unable to relate security to the business Uncertain about effectiveness of security measures and program Unfamiliar with traditional management and planning tools Reluctant to defer to management s priorities These result in management s perception of security as a necessary evil. More Findings Management would like Security to: Manage costs Relate security to the business Report about itself like other business functions do Articulate specific objectives of programs and projects Be in tune with management s priorities Security Metrics are a big part of this. 4

5 Key Resources Key Resources

6 Security and Management Business Assets and Risks They are corporate assets, not security assets. Executive management makes the risk decisions. Security Metrics Management, page 11 Security and Management Business Assets and Risks Business assets are the property of the business owners Ownership has delegated the care and protection of those assets to the executive management team. Risks to business assets and risk decisions are the responsibility of executive management. 6

7 Security and Senior Management Risks Accountability Management can delegate security risk decision authority, but it cannot delegate away management s accountability. Thus executive management retains certain rights (and responsibilities) relating to security decisions, for without them they would not have the power to act in accordance with their own responsibility. However: senior executives are not knowledgeable or experienced in security risk management. Security and Senior Management Management Asks What is all this security costing me? What am I getting for the money I spend? Is it working? How do you know it s working? Can it be done at less cost? When some adverse event occurs: Why isn t it working? or What went wrong? Instead of selling management on security, include management in security. 7

8 Security and Senior Management Risks Accountability Security executives must provide security risk information and offer recommendations to executive management, so that management can make informed risk decisions. ISO identifies: Critical Asset Inventory Assessment of Threats, Vulnerabilities and Risks to Assets Risk Treatment Plan Statement of Applicability (why specific security measures are or are not used) Security and Senior Management Risk Management Information Security should report on: Critical Asset Inventory: relating assets to critical business functions Assessment of Threats, Vulnerabilities and Risks to Assets: reporting critical vulnerabilities Risk Treatment Plan: Basis for Risk Manager and CFO to provide approvals Statement of Applicability: Input to Risk Manager and CFO evaluation of security plans Once approved you manage, and report on results, using metrics. 8

9 Security Drivers Security Metrics Management, p. 20 Security Drivers Security Metrics Management, p. 25 9

10 Relating to the Business Security Cost Metrics Examples Security costs worldwide as a percentage of sales (10-year trend) Security costs per employee (10-year trend) Security costs as ratio of employees to security staff (trend and by region) Security Metrics Management, pp Relating to the Business Security Cost Metrics Examples Average cost of individual employee background checks (month and year trends) Average cost to issue an employee badge (trends) Security officer force overtime (projected vs. actual, plus trend) 10

11 Relating to the Business Security Cost Metrics Examples Costs per month for incident investigation Cost per incident for incident investigation Relating to the Business Security Effectiveness Metrics General employee population vs. those who have access to sensitive information Breakdown of information access by sensitive information category (Trade Secret, Proprietary) Security Metrics Management, p

12 Relating to the Business Security Effectiveness Metrics Number of security briefings given Security briefing attendance (desired vs. actual) Security Metrics Management, pp Relating to the Business Additional Effectiveness Metrics Number of employee candidates failing background checks Number of new hires failing security criteria Security Metrics Management, p

13 Security Planning Metrics Relating to the Business Number of computer systems purchasing budgets/allocations that include the cost of their security M/A budgets that incorporate the cost of their security Security Metrics Management, pp Security Assessment Metrics Relating to the Business 13

14 Ways an SMMP Can Help Some Benefits Identify the costs of a Corporate Assets Protection Program (CAPP). Analyze the security functional processes to identify the individual functional costs. Identify areas where efficiency gains can be made. Identify the effectiveness of security functions. Track the costs and benefits of changes to security processes. Measure the successes of the CAPP. Demonstrate to management changes/improvements in the efficiency. and effectiveness of security processes. Provide management with a performance assessment of the CAPP. What is a Metric? A statistical measure of performance, process or product A tool to determine variation and relationship between variables 14

15 How Metrics Are Used Increase Efficiencies Increase Quality Align Department Goals with the Corporate Mission What is Important To Monitor Goal Alignment What is Important to the Organization What is Important to the Security Department What will Increase Efficiencies What will Increase Customer Satisfaction What will Increase Quality What will Make Your Job Better or Easier 15

16 What is a Metrics Based Program? Collection of General Data To Identify Problems, Then Analysis Problem Specific Data, To Formulate a Plan for Improvement, Then Monitor the Improvement Plan To Remain Focused on Assuring Continuous Improvement What is a Metric? Patrols Number of stations hit on each tour Time it takes to complete a patrol The process of screening and registering visitors The process of generating and steps in conducting a background investigation 16

17 Starting To Use Metrics Collect Baseline Data Start with: Security Surveys Manpower Statistics Department Activities Crime Statistics Use Tally Sheets DAILY STATISTICS SHEET SUPERVISOR: DAY: DATE: SHIFT: DEPARTMENT STATISTICS Alarms Response Fire Alarm Post Inspection Alarms Panic Fire Drill Process Server Apprehension Hazard Report Report Taken Arrest Lost and Found Smoking, Employee Bank Deposit Morgue Release 17

18 PATIENT STATISTICS ACS Watch Room Search Transport Out Escort Smoking, Patient VIP Detail Medicated Patient Supervised Visit Visitor Check Restrained Patient Transport Court Visitor Ejection DOOR OPEN (Requestor's Name, Building, Room # Reason) Start End (Requestor's Name, Building, Room # Reason) Start End (Requestor's Name, Building, Room # Reason) Start End (Requestor's Name, Building, Room # Reason) Start End (Requestor's Name, Building, Room # Reason) Start End 18

19 Operating a Metrics Based Program Identify Problems Use Frequency Analysis look for patterns or trends in frequency of occurrence (highs/lows) Identify the top five and bottom five Decide which out of the top five you want to tackle first mix the easy with the hard. Drilling Down The Data Analysis Problem Specific Data Break down the process into its simplest functions For Example: Patrols Start End Time Time between stations Station Placement Training Route 19

20 Operating a Metrics Based Program Formulate a Plan for Improvement What functions have been identified and need to be fixed How are you going to fix them Design a plan of correction with a definitive time line and correction goal Operating a Metrics Based Program Monitor the Improvement Plan Collect More Data Analyze the Data AGAIN Keep an Eye on the Timeline If the Correction Plan is Not Working STOP Rethink the Plan and Try Something Else Don t Be Afraid to Try Something New 20

21 Metrics Tips Remain Focused on Improvement Remember Why You are Doing This Don t Get Lost In the Process What Results To Expect REMEMBER Metrics Will: Make You More Efficient Reduced Costs Increase Quality Keep Management In-Tune with Security 21

22 Thank You! Questions? Ray Bernard PSP RBCS President, Ray Bernard Consulting Services Website: Bernard J. Scaglione, CPP Director of Security, New York Presbyterian Hospital 22