News

Industries

Companies

Jobs

Events

People

Video

Audio

Galleries

My Biz

Submit content

My Account

Advertise with us

Security metrics at the grassroots level

Figuring out the state of your security program involves dealing with a lot of noise - vendors, consultants, auditors and other outsiders whose message is coated with layers of personal bias and agendas. Metrics are the objective way to go, writes columnist Ed Moyle. However, tackling a metrics initiative can be overwhelming - unless you start small.

Want to try an experiment?

Part 1: Get yourself a crowd of willing co-experimenters (about 20 to 30) and tell them that you're going to ask them a trivia question. Tell them you're going to read the question to them and when you count to three, everyone should shout out their answer at the same time. They should all shout out a guess -- even if they have no clue what the answer is. Just yell it out.

Then ask the group some really esoteric question -- one that most people are unlikely to know but that isn't so out there that it's unanswerable. For example, "Who was the last surviving Bounty mutineer on Pitcairn Island when it was discovered by the Topaz in 1808?" Most people won't know that. Some people might have the right answer -- but if so, I guarantee you won't be able to hear it over everyone else shouting their guess when the time comes to answer.

Part 2: Now, ask the crowd the same question again -- but this time tell people to shout out an answer only if they are certain they're right. No guessing this time. Instead, only people that are completely confident should respond.

Guess what? Most likely at least one person in the crowd will know the answer, and this time, everyone will hear them say it. In the first case, knowledge is stifled; in the second, it is shared. The trick is increasing the signal to noise ratio.

Read the full article

Let's do Biz