I have found the Metrics Prophet for our times, 
and his name is Andrew Jaquith.

I stumbled home yesterday from work, 
sleep-deprived, jittery, and feverish from 
an oncoming cold.  I tucked myself into 
bed, hoping to sleep—but I could not sleep
until I had read Security Metrics cover to
cover.  It was That Good.

Now, either that makes me the biggest
saddo anorak west of the Pond, or it
means Jaquith is an extraordinary writer
about what would otherwise be an
extremely dull subject.  I would of course
prefer to think it’s the latter, and I’m
sure he would too.

First off, his writing is chock full of
playfulness and amusing literacy, from the
literary nods ("Call me Analyst.") to the
rimshots ("… the top and bottom 50% are
divided by—wait for it—the median!"). 

Secondly, his metrics are for the most part
accessible, meaning that as soon as I see
them, I think, “Yeah, I could get those!”
And a whole lot of them are ones I’d
already thought of, but there are a few
gems in there that were like little Altoids
in my mouth, that made me sit up and
go, “Whoa.”

You can see the rest of her review on her website. If you are thinking of buying the book, her comments should give you an idea of what is inside. She has some excellent and perceptive constructive criticisms also, which are all on target.

Ms. Shrdlu, thanks very much for the kind words. I especially appreciate that she caught my nod to Herman Melville in the first line of the book ("Call me Analyst.").

MetriCon 2.0 CFP

August 7, 2007 Boston, MA

Overview

Do you cringe at the subjectivity applied to security in every manner? If so, MetriCon 2.0 may be your antidote to change security from an artistic "matter of opinion" into an objective, quantifiable science. The time for adjectives and adverbs has gone; the time for hard facts and data has come.

MetriCon 2.0 is intended as a forum for lively, practical discussion in the area of security metrics. It is a forum for quantifiable approaches and results to problems afflicting information security today, with a bias towards practical, specific implementations. Topics and presentations will be selected for their potential to stimulate discussion in the Workshop.

MetriCon 2.0 will be a one-day event, Tuesday, August 7, 2007, co-located with the 16th USENIX Security Symposium in Boston, MA, USA (http://www.usenix.org/events/sec07/). Beginning first thing in the morning, with meals taken in the meeting room, and extending into the evening. Attendance will be by invitation and limited to 60 participants. All participants will be expected to "come with findings" and be willing to address the group in some fashion, formally or not. Preference given to the authors of position papers/presentations who have actual work in progress.

Each presenter will have 10-15 minutes to present his or her idea, followed by 15-20 minutes of discussion with the workshop participants. Panels and groups of related presentations may be proposed to present different approaches to selected topics, and will be steered by what sorts of proposals come in response to this Call.

Goals and Topics

The goal of the workshop is to stimulate discussion of and thinking about security metrics and to do so in ways that lead to realistic, early results of lasting value. Potential attendees are invited to submit position papers to be shared with all. Such position papers are expected to address security metrics in one of the following categories:

• Benchmarking
• Empirical Studies
• Metrics Definitions
• Financial Planning
• Security/Risk Modeling
• Tools, Technologies, Tips, and Tricks
• Visualization

Practical implementations, real world case studies, and detailed models will be preferred over broader models or general ideas.

How to Participate

Submit a short position paper or description of work done/ongoing. Your submission must be no longer than five(5) paragraphs or presentation slides. Author names and affiliations should appear first in/on the submission. Submissions may be in PDF, PowerPoint, HTML, or plaintext email and must be submitted to MetriCon AT securitymetrics.org.

Presenters will be notified of acceptance by June 22, 2007 and expected to provide materials for distribution by July 22, 2007. All slides and position papers will be made available to participants at the workshop. No formal proceedings are intended. Plagiarism constitutes dishonesty. The organizers of this Workshop as well as USENIX prohibit these practices and will take appropriate action if dishonesty of this sort is found. Submission of recent, previously published work as well as simultaneous submissions to multiple venues is acceptable but please so indicate in your proposal.

Location

Cost

Important Dates

Workshop Organizers

A Book You Should Buy

Finally, I’d like to point you to this. It’s a book
every analyst should own, written by a very smart person
(Andrew Jaquith), and filled with - mostly  - very
good material... Metrics are great, but there are so
many, many ways to get them wrong... Do go out
and obtain a copy for yourself and/or your analysts.
You won’t be disappointed. It’s one of those books
you’ll actually use.

Thanks so much, Alex! When I see you at MetriCon 2.0 later this year, you've got a beer coming to you.