Relationships between information security metrics
Rodrigo Sanches Miani, Michel Schatkin Cukier, Bruno Bogaz Zarpel�ão, Leonardo de Souza Mendes · 2013
Finding relevant metrics in information security is an important but difficult problem. In this paper, we propose to empirically investigate the relevance of different security metrics that could be derived from intrusion prevention system (IPS) alert events and computer security incident data. Based on the data provided by the University of Maryland, we show that IPS metrics are linked to security incidents, and also that different types of security incidents have different significant metrics. These results can be used for identifying possible candidates for security incident indicators, developing methods to improve incident prevention and helping organizations interpret their IPS's better in the future.