Incidents by definition or successful attacks and are within our control to the extent that our control infrastructure works to minimize them. If they are entirely out of our control, we wouldn’t have a profession (or a job).

It is okay to be skeptical, but I recommend not giving up without looking a bit more closely, and with fewer analogies.

Thanks for the comment,

Pete

Applying these to other areas, like manufacturing or software development, has a lot more of the metrics under the control of the individual. Many areas even know the industry values for many things. Auto mechanics have a book that tells how long a given repair should take.

I don’t see how we are ever going to get to that state since we don’t have a repeatability to many things here, especially the incidents as I discussed above.

That makes me wonder if the whole focus on metrics is ultimately a waste of time….

Brad

As always, a good post. Can you bring this to more practical terms?

What would your Infosec approach for metrics be at a technology manufacturing company or an Online business?

Thanks,
PhilA