Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Bad security metrics: the problem and its solution

Published

Author(s)

David W. Flater

Abstract

It is generally acknowledged that few security metrics have the level of predictive validity that their uses require, but neither the nature of the problem nor the steps needed to avoid it have been fully characterized. This article examines both questions through the lens of basic measurement theory, which (1) demonstrates a method by which intrinsically weak metrics can be dismissed quickly, before sunk costs become significant, and (2) provides positive advice on how the metrics can be strengthened to provide moderate but verifiable value.
Citation
IT Professional (IEEE)

Keywords

security, measurement, metrics, scale theory

Citation

Flater, D. (2018), Bad security metrics: the problem and its solution, IT Professional (IEEE), [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=924554 (Accessed June 18, 2024)

Issues

If you have any questions about this publication or are having problems accessing it, please contact reflib@nist.gov.

Created January 4, 2018, Updated May 27, 2020