Pragmatic Security Metrics

Like all books on metrics, Pragmatic Security Metrics: Applying Metametrics to Information Security makes the statement that "you can't manage what you can't measure." The authors claim that other books on information security metrics discuss number theory and statistics in academic terms. This title promises to be light on mathematics and heavy on utility and is meant as a how-to-do-it guide for security metrics. As for the title, Pragmatic is an acronym for the basis of the method of the book, using metrics that are predictive, relevant, actionable, genuine, meaningful, timely, independent, and cost-effective. After reading the first chapter, Pragmatic Security Metrics: Applying Metametrics to Information Security looks like it may live up to its promise of being able to use metrics not only to track and report performance but to identify problem areas and opportunities.