Security Metrics: Replacing Fear, Uncertainty, and Doubt

4

Measuring Program Effectiveness

Trust, but verify.

—Ronald Reagan, ca. 1987, quoting Vladimir Ilyich Lenin

My first job out of college was as a self-employed programmer. After a year and a half of steady and profitable work, I realized that I could either continue to burnish my skills as a developer or do something broader and more business-oriented. I interviewed with a gentleman named Ray,¹ an executive with a large transportation services company whose trucks you’ve probably seen on the highway. Ray was starting a new European subsidiary on behalf of the parent company, and as part of that effort he hired me as a business and technology analyst.

The year was 1993. An ex-consultant with Mercer Management Consulting, Ray was about as organized, ...