Security Metrics: Replacing Fear, Uncertainty, and Doubt

Acknowledgments

It is a dark and stormy night. Thanksgiving 2006, the occasion on which I write these words, has brought some of the worst rain and wind in my memory. Not that the weather matters one whit. Blissed out on tryptophan, pie, and stuffing, I could care less about the sheets of rain outside my window.

Food seems an appropriate metaphor today—not just because of the occasion, but because it reminds me of a simile for Security Metrics. The endeavor of writing this book has been, as the expression goes, like eating an elephant. The only way to do it is one bite at a time.

I first glimpsed the elephant while I was working at @stake, an Internet security consultancy I helped start in 1999. One of my colleagues was a cheerful, pint-sized ...