Information Security Management Metrics

155

15Chapter

Conclusions

It is evident that we must measure to manage and yet as we have demonstrated,

most approaches to contemporary metrics are not useful for management or strate-

gic purposes and, all too often, not particularly beneficial for operational decisions

either. It is the hope that the shift in perspective offered will allow a more focused

approach toward developing methods for collecting the information needed for

more effective information security management.

15.1 Predictive Metrics

Key performance indicators (KPIs) are sometimes termed leading indicators but

to a significant extent that can be misleading. Inadequate performa