Security Metrics Management

by Kovacich

• ISBN13: 9780750678995
• ISBN10: 0750678992
• Format: Hardcover
• Copyright: 2005-11-30
• Publisher: Elsevier Science

Summary

Security Metrics Management offers straight-forward solutions to measure the costs and benefits of an assets protection program. The book provides tools that enable the reader to analyze both the successes and failures of a security system, using this information to improve upon the system's overall effectiveness.

Table of Contents

Preface	xiii
Acknowledgments	xxi
Foreword	xxiii
Introduction	xxv
Section I: Introduction to the Role of the Security Professionals and Security Metrics Management	1	(80)
The Security Profession and Its Role in Supporting Business and Government Agency Assets Protection Needs	3	(10)
Introduction	3	(2)
The Need for Security Professionals in Business	5	(3)
Corporate Security Today	8	(1)
The Role of the Corporate Security Professional	8	(1)
The Required Skills of the Security Professional	9	(1)
What Kind of People Are Needed?	10	(1)
Why the Corporate Security Professional?	10	(1)
Where is Security's Place in the Corporation?	11	(1)
Summary	12	(1)
Management and Security Metrics Management Foundation	13	(6)
Introduction	13	(1)
Security From an Executive Management Perspective	13	(4)
Summary	17	(2)
Policies, Procedures, Processes, Plans and Projects	19	(18)
Introduction	19	(1)
Triad of Assets Protection and Security Functional Drivers	20	(1)
Part One of the Security Drivers' Triad: Risk Management Drivers	20	(1)
Part Two of the Drivers' Triad: Corporate Decisions' Drivers	21	(1)
Part Three of the Drivers' Triad: Laws, Regulations, Best Business Practices, Ethics and Privacy Drivers	22	(2)
Summary of Drivers	24	(1)
CAPP-Related Policies	25	(1)
CAPP-Related Procedures	25	(1)
CAPP-Related Processes	26	(1)
Process Management	27	(1)
Performance Management	28	(1)
CAPP-Related Plans	28	(1)
CAPP-Related Projects	29	(5)
Security Duties and Responsibilities	34	(1)
Corporate Assets Protection Program (CAPP)	34	(1)
Summary	35	(2)
Security Metrics Management Program---An Overview	37	(22)
Introduction	37	(1)
First Steps in the Development of an SMMP	38	(2)
Security Metrics Management is not Rocket Science	40	(3)
Questions Concerning Data Collection	43	(1)
SMMP Chart Designs	44	(1)
Using Technology to Deliver Metrics Data	44	(1)
Quality and Oversight	45	(1)
Security Metrics and Processes	46	(1)
Cost-Avoidance Metrics	47	(1)
Using Metrics Charts for Management Briefings	47	(1)
Sequence of Assets Protection Charts for Management Briefings	48	(2)
Case Study: Metrics Data Collection Example---Badge-Making Process	50	(1)
SMMP and Executive Management	51	(1)
Case Study: Use of Metrics in Times of Downsizing Security Staff	52	(1)
More on SMMP and Downsizing	53	(3)
Case Study: Charting Assets Protection Infractions as Part of an SMMP and Briefing Management on the Results	56	(1)
Case Study---Using Metrics to Determine Success	57	(1)
Summary	58	(1)
Case Study: Measuring the Costs of Security	59	(16)
Introduction	59	(1)
IWC Assets Protection Survey Questionnaire	60	(4)
Examples of Some Metrics Charts	64	(10)
Summary	74	(1)
Case Study: Six Sigma	75	(6)
Introduction	75	(1)
A Case Study---Another Approach to Security Metrics Management	75	(2)
Case Study---Patch Management	77	(3)
Conclusion	80	(1)
Section II: Administrative Security Metrics	81	(96)
Information Security	83	(16)
Introduction	83	(4)
Three Basic Categories of Information	87	(1)
An Information Protection Philosophy	88	(1)
Business Information Types and Examples	89	(1)
Security Drivers	90	(1)
Information Security Process Flowcharts	90	(2)
What, When, Who, Where, How of Data Collection	92	(1)
Sample Metrics Charts	93	(2)
A Case Study	95	(2)
Summary	97	(2)
Personnel Security	99	(16)
Introduction	99	(1)
Pre-Employment and Background Investigations	100	(1)
Basics of Pre-Employment Checks	101	(1)
What Are Pre-Employment Background Investigations?	101	(1)
Pre-Employment and Background Investigations Drivers and Flowcharts	101	(2)
Sample Pre-Employment and Background Investigations Metrics Charts	103	(6)
Workplace Violence	109	(1)
Workplace Violence Prevention Program	110	(1)
Case Study	111	(3)
Summary	114	(1)
Security Education and Awareness Training	115	(12)
Introduction	115	(1)
SEATP Organization	116	(1)
SEATP Drivers and Flowcharts	117	(1)
SEATP Metrics	118	(1)
Sample SEATP Metrics Charts	119	(3)
Data Collection And Metrics Management	122	(2)
SEATP Case Study	124	(2)
Summary	126	(1)
Security Compliance Audits	127	(10)
Introduction	127	(1)
SCA Organization	127	(1)
SCA Drivers and Flowcharts	128	(1)
SCA Metrics	129	(2)
SCA Metrics Charts---A Sampling	131	(3)
The Who, How, Where, When, Why and What of SCA Metrics Tracking	134	(1)
SCA Case Study	135	(1)
SCA Summary	136	(1)
Surveys and Risk Management	137	(16)
Introduction	137	(2)
SRM Drivers and Flowcharts	139	(1)
Sample SCA Metrics Charts	140	(2)
The Who, How, Where, When, Why and What of SRM Metrics Tracking	142	(1)
Case Study	143	(9)
Summary	152	(1)
Corporate Assets Protection Program	153	(10)
Introduction	153	(3)
The CAPP and Other Drivers, Plans and Their Flowcharts	156	(1)
CAPP Data Collection and Security Metrics Management	157	(1)
Is the CAPP Working as Planned?	157	(2)
Is It Effective?	159	(1)
How Much Does It Cost?	159	(2)
How Can It Be Done Better?	161	(1)
How Can It Be Done Cheaper?	161	(1)
Case Study	162	(1)
Summary	162	(1)
Contingency Planning	163	(14)
Introduction	163	(2)
Contingency Planning Organization	165	(1)
Contingency Planning Drivers and Flowcharts	165	(6)
Examples of Contingency Planning Metrics' Measurement Tools	171	(4)
Contingency Planning Case Study	175	(1)
Summary	175	(2)
Section III: Physical Security Metrics	177	(54)
The Guard Force	181	(8)
Introduction	181	(2)
Guard Force Security Organization	183	(1)
Guard Force Security Drivers and Flowcharts	183	(1)
Guard Force Metrics Charts Examples	184	(2)
Guard Force Case Study	186	(2)
Guard Force Summary	188	(1)
Technical Security Systems	189	(12)
Introduction	189	(1)
Technical Security Systems Organization	189	(1)
Technical Security Systems Flowcharts	190	(2)
Technical Security Systems Metrics	192	(7)
Technical Security Systems Case Study	199	(1)
Summary	200	(1)
Locks and Keys	201	(8)
Introduction	201	(1)
Locks and Keys Organization	202	(1)
Locks and Keys Drivers and Flowcharts	202	(1)
Locks and Keys Examples of Security Metrics	203	(3)
Lock and Key Case Study	206	(1)
Summary	207	(2)
Fire Protection	209	(8)
Introduction	209	(1)
Fire Protection Organization	210	(1)
Fire Protection Drivers and Flowcharts	211	(2)
Fire Prevention And Suppression Metrics Examples	213	(3)
Case Study---Outsourcing Fire Prevention and/or Suppression	216	(1)
Summary	216	(1)
Executive Protection	217	(8)
Introduction	217	(2)
Executive Protection Organization	219	(1)
Executive Protection Drivers and Flowcharts	220	(1)
Executive Protection Examples of Metrics	221	(2)
Executive Protection Case Study	223	(1)
Summary	223	(2)
Event Security	225	(6)
Introduction	225	(1)
Event Security Organization	225	(1)
Event Security Drivers and Flowcharts	226	(1)
Event Security Metrics	227	(2)
Event Security Case Study	229	(1)
Event Security Summary	229	(2)
Section IV: Security Operations Metrics	231	(52)
Investigations and Noncompliance Inquiries	233	(12)
Introduction	233	(1)
Investigations and NCI Organization	233	(1)
Investigations and NCI Drivers and Flowcharts	234	(1)
Investigations and NCI Examples of Metrics	235	(6)
Investigations and NCI Case Study	241	(2)
Investigations and NCI Summary	243	(2)
Government Security	245	(10)
Introduction	245	(2)
IWC's Government Security Organization	247	(1)
Government Security Drivers and Flowcharts	248	(1)
Government Security Examples of Metrics	249	(2)
Government Security Case Study	251	(2)
Government Security Summary	253	(2)
Information Systems Security	255	(10)
Introduction	255	(1)
Infosec Organization	256	(2)
Infosec Drivers and Flowcharts	258	(4)
Infosec Examples of Metrics	262	(2)
Infosec Case Study	264	(1)
Infosec Summary	264	(1)
Mergers, Acquisitions or Divestitures Security	265	(10)
Introduction	265	(1)
MAD-Related Security Organization	266	(2)
MAD Security Drivers Flowcharts and Checklists	268	(1)
MAD---Examples of Metrics	269	(1)
Checklists	270	(3)
MAD Case Study	273	(1)
MAD Summary	274	(1)
Outsourcing	275	(8)
Introduction	275	(2)
Outsourcing Organization	277	(1)
Outsourcing Drivers and Flowcharts	278	(1)
Outsourcing Examples of Metrics	278	(2)
Post-Contract Award	280	(1)
Outsourcing Case Study	281	(1)
Outsourcing Summary	282	(1)
Section V: The Security Profession and Metrics Management in the Future	283	(12)
Security Metrics Management Technology of the Future and How to Prepare Now to Use It	285	(10)
Introduction	285	(1)
New Technology	286	(1)
Applying High Technology to the Security Metrics Management Program	287	(2)
Application Software Tools For Today	289	(1)
Evaluating Current And Future Data Collection Needs	289	(2)
Current and Future---``Tools''---Hardware and Software to Support an SMMP	291	(3)
Summary	294	(1)
Appendix: Security Benchmarking Group Survey	295	(22)
About the Authors	317	(2)
Index	319