CMS Security Handbook: The Comprehensive Guide for WordPress®, Joomla!®, Drupal™, and Plone®

Security Metrics

Author W. Edwards Deming has been considered by many to be the father of modern quality. He was an advocate of processes versus quotas.

His background was in manufacturing quality, but his principles still apply. He advocated crafting a process and the proper measurement, and then fine-tuning the process to achieve better numbers. He was against the ideas of “mass inspection” and “quotas.” In this sense, a quota is pieces built per hour, or number of units inspected per hour.

Deming pointed out that, in manufacturing, you cannot put quality into a product through the process of mass inspection. It must be designed from the start, and that includes a process to create it. Including metrics for the sake of having metrics might be impressive to upper management, but they mean nothing if they are not applied in an effort to improve. In his extensive work in the manufacturing space, Deming advocated consistency and improvement within statistical boundaries, not just the inclusion of numbers.

Your infrastructure should be measured against a metric to determine the quality of your security. It should be a gauge of how safe your site is against attack. Note that the last sentence did not say “impervious to attack,” because that site doesn't exist. Rather, there are degrees of safety, and the metrics examined next should help you reach a higher degree of safety.

Deming advocated “constantly and forever” improving quality. With that goal in mind, take a look at security ...