How many patches did you apply last quarter? It is an important question, but it isn't a strategic one. In order to think about risk and security, we need to elevate our discussion from the operational, such as patch levels and coverage, to the strategic.

One way to do this elevation is take a step back and consider where the risk comes from. It isn't uncommon to get caught up in our ACLs and tokens and signatures and simply work within the domain of security controls. So we associated our risk with the failure of controls. But that is only part of the story, and in a lot ways not even the most important part. Even regulations tend to focus more on control weaknesses than they do the underlying assets. And so we lose focus.

If we are thinking strategically, we must consider risk from the business technology perspective (you could even think more broadly if you like, but I find that a bit ambiguous from a metrics perspective and consider it out-of-scope). Thinking this way, it becomes obvious that the future "unwanted outcomes" that constitute our risk, and which we are trying to prevent, are attacks, exploits, compromises, and losses. Further, it is clear to see that these unwanted outcomes occur within the set of all systems activity and therefore this activity is a key aspect of the risk we are trying to minimize. For our purposes, consider these generic system activities that involve an input source and a target transactions.

We also know that risk has two components – a likelihood component that we can derive from the transactions discussed above, and a value component that identifies the amount of money at risk. We don't specifically need this latter one if we all qualitatively recognize the value of, say, a system compromise. However, understanding and quantifying value is an inherent part of what we do, and is crucial to our decisionmaking process. So the second piece of the model is value.

Now, we can start discussing the security controls in place and how they effect the transactions occurring in the IT environment. These controls are applied to transactions that may be good or bad, and result (simplistically) in a decision to allow or deny a transaction. We end up with four possible outcomes from any control test – good | allow; bad | allow; good | deny; and bad | deny. Controls are the third aspect to the strategic metrics model.

Finally, we have incidents. These are somewhat self-explanatory at the level we are operating on. Incidents are simply the manifestation of the unwanted outcomes. The frequency of these incidents within the context of the full volume of transactions provides historical information that can help estimate the risk associated with the population.