Security Metrics: Replacing Fear, Uncertainty, and Doubt

1

Introduction: Escaping the Hamster Wheel of Pain

If you’re in a security-based startup company, then you’ll know that making money requires making excitement, even if the excitement is somebody else’s public humiliation.

—Daniel E. Geer, Sc.D., “Risk Management Is Where the Money Is” (1998)

RISK MANAGEMENT IS WHERE THE CONFUSION IS

Call me Analyst.

I am blessed with a lucky job: customers pay my firm money to help them navigate the product-and-services markets for information security. I write original research, speak with enterprise customers, and speak with product vendors on a regular basis. Lately I have been accumulating a lot of slideware from security companies advertising their wares. In just about every deck the purveyor bandies ...