Cyber Security Engineering: A Practical Approach for Systems and Software Assurance

Chapter 6. Metrics

In This Chapter

• 6.1 How to Define and Structure Metrics to Manage Cyber Security Engineering

• 6.2 Ways to Gather Evidence for Cyber Security Evaluation

6.1 How to Define and Structure Metrics to Manage Cyber Security Engineering

A measure is defined as “an amount or degree of something”; it is an operation for assigning a value to something.¹ A metric is defined as “a standard of measurement”; it is the interpretation of assigned values.² Scientist Lord Kelvin said, “When you can measure what you are speaking about, and express it in numbers, you know something about it; but when you cannot measure it, when you cannot express it in numbers, your knowledge is of a meager and unsatisfactory kind; it may be the beginning ...