Techniques for enterprise network security metrics
Anoop Singhal, Xinming Ou · 2009
Currently, it is difficult to answer simple questions such as we more secure than yesterday or how should we invest our limited security resources. Decision makers in other areas of business and engineering often use metrics for determining whether a projected return on investment justifies its costs. Spending for new cyber-security measures is such an investment. Thus security metrics that can quantify the overall risk in an enterprise system are essential in making sensible decisions in security management.