What are the key indicators for assessing the level of IT security in your organisation and helping to reduce your risks? Find out which indicators to monitor, how to set up an information system security dashboard, how to automate analyses, and more. Concrete examples and best practices to guarantee optimal data protection and achieve your IT security objectives.
IT security professionals know that analysing and tracking the most relevant indicators can make all the difference between good data protection and increased vulnerability to the threats of the day. Do you sometimes find yourself navigating an endless ocean of security information, trying to make sense of it? This guide not only helps you understand what to look for, but also provides the tools to analyse the results quickly and take the appropriate measures to improve data protection.
IT security indicators
IT security indicators are measurements that allow Chief Information Security Officers (CISOs) and Chief Information Officers (CIOs) to assess the security level of the information system. They can be used to monitor the effectiveness of security policies, identify vulnerabilities and take measures to improve data protection.
Main IT security indicators
The main IT security indicators to monitor include the vulnerability rate, data protection, the time to recover after an incident, the number of attacks per day and the usage rate of security tools. These indicators can be used to assess the effectiveness of security policies and to identify potential risks.
Data sources to take into account
The data sources to take into account when tracking these indicators include activity logs, monitoring tools and compliance reports. CISOs and CIOs must analyse this data in order to identify trends and determine whether the system is sufficiently protected against threats.
Key figures to monitor
Several key figures related to IT security indicators need to be monitored, in particular the vulnerability rate (the total number of vulnerabilities relative to the total number of applications), the data protection rate (the total number of breaches relative to the total number of users) and the mean time to recover after an incident (the average time taken to restore a system after an attack).
Which IT security KPIs should you track?
An indicator only has value if it triggers a decision. The KPIs below answer the questions a CISO must be able to address in front of senior management: are we detecting quickly, are we remediating quickly, are the fundamentals in place, are employees following, where does compliance stand.
- Mean time to detect (MTTD): the time elapsed between the start of an incident and its detection. Definition and ways to reduce it in our article on MTTD.
- Mean time to respond (MTTR): the time between detection and the return to normal. See our article on MTTR.
- Number of security incidents per period, with the share of major incidents. The trend matters more than the absolute value.
- Rate of critical vulnerabilities fixed within the target timeframe, for example 30 days, and the average age of the vulnerabilities still open.
- Patch coverage: the share of servers and workstations that are up to date with security patches.
- Multi-factor authentication activation rate, with priority on privileged accounts and remote access.
- Click rate and reporting rate during simulated phishing campaigns. The second is the more telling of the two.
- Share of employees who have received awareness training over the last twelve months.
- Compliance rate per framework (ISO 27001, NIS 2, DORA), calculated requirement by requirement.
- Share of critical suppliers assessed and the residual risk level of the ecosystem.
- Rate of security plan actions closed on time: this is the indicator that shows whether the others are moving.
Around ten indicators are enough for an executive committee. Each one must have an owner, an identified data source and an alert threshold. A cybersecurity dashboard brings them together and automates their calculation. In Make IT Safe, the dashboard of the risk management module displays risks and their criticality, and each risk is linked to the corrective actions and to the requirements of the frameworks.
Assessing the impact of indicators on IT security
Once CISOs and CIOs have identified the main indicators to monitor, they must assess the impact these have on the security of the information system.
Analysing the data collected
To assess the impact of the indicators on IT security, CISOs and CIOs must analyse the data collected and determine whether the system is sufficiently protected against threats. They must also monitor the risks and threats that can affect the information system and take measures to reduce those risks.
Risks and threats to monitor
The main risks and threats to monitor include denial-of-service (DDoS) attacks, loss or theft of data, unauthorised access to systems, fraudulent manipulation of data and file corruption. CISOs and CIOs must monitor these risks in order to make sure that the system is sufficiently protected against these threats.
Measures to take to avoid the risks
To avoid these risks, CISOs and CIOs must put strict security policies in place, train staff in IT security and continuously monitor threats. They must also set up monitoring tools to detect any suspicious activity quickly and take immediate measures to remedy it.
Other aspects to consider
CISOs and CIOs must also take into account the level of automation of the indicator tracking process. Fully automating the process can help reduce the time needed to monitor the indicators and quickly identify any potential problem.
Once CISOs and CIOs have identified the main indicators to monitor, they can automate the indicator tracking process in order to improve the efficiency of the information system.
Automating the indicator tracking process
The indicator tracking process can be automated by using an information system security dashboard. Such a dashboard is a tool that allows CISOs and CIOs to easily collect, store, analyse and display all the relevant data related to IT security indicators.
Creating a dashboard to track and display the data
To create an information system security dashboard, CISOs and CIOs must define clear and specific objectives for IT security. They must then collect the relevant data from the appropriate sources and analyse it in order to identify trends and take measures to improve the security of the information system.
Available automation tools and systems
Several automation tools and systems available on the market can be used to automate the indicator tracking process. The main tools include Splunk, LogRhythm, IBM QRadar, AlienVault USM and McAfee Enterprise Security Manager.
Plan to adopt for tracking IT security indicators
CISOs and CIOs must draw up a detailed plan for monitoring IT security indicators. This plan should include a list of the indicators to monitor, a description of the data sources to be used, a description of the means of automating the tracking process and a description of the measures to take if a problem is identified.
Examples of indicator use in organisations
Many companies use IT security indicators to monitor the effectiveness of their information system. For example, a company can monitor its vulnerability rate in order to check that all its applications are sufficiently protected against threats.
Another company can monitor its data protection rate in order to check that all employees comply with IT security policies.
