Comments on: You’ve Got To Move It Move It http://newschoolsecurity.com/2009/10/youve-got-to-move-it-move-it/ The Blog Inspired By The Book Wed, 16 May 2012 16:05:54 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Russell http://newschoolsecurity.com/2009/10/youve-got-to-move-it-move-it/#comment-399 Russell Tue, 20 Oct 2009 00:19:33 +0000 http://newschoolsecurity.com/?p=759#comment-399 Great post, Josh, and very good discussion from wgragido, ean, and gorrie. Regarding what InfoSec people and CISOs should do differently to evolve/change/adapt more effectively, we could start by including some "meta-metrics" for organization learning, agility, etc. I gave a presentation at Metricon a few years ago on this topic: ""Security Meta Metrics – Measuring Agility, Learning, and Unintended Consequences" http://meritology.com/resources/Security%20Meta%20Metrics.ppt . It includes some specific ideas for such metrics, but really almost any metric will be better than the willful ignorance that most security organizations have today about continuous learning. Great post, Josh, and very good discussion from wgragido, ean, and gorrie.

Regarding what InfoSec people and CISOs should do differently to evolve/change/adapt more effectively, we could start by including some “meta-metrics” for organization learning, agility, etc.

I gave a presentation at Metricon a few years ago on this topic: “”Security Meta Metrics – Measuring Agility, Learning, and Unintended Consequences” http://meritology.com/resources/Security%20Meta%20Metrics.ppt . It includes some specific ideas for such metrics, but really almost any metric will be better than the willful ignorance that most security organizations have today about continuous learning.

]]>