{"id":1539,"date":"2017-03-20T14:06:24","date_gmt":"2017-03-20T14:06:24","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=1539"},"modified":"2017-03-18T22:33:31","modified_gmt":"2017-03-18T22:33:31","slug":"dashboards-vs-security-really-helping","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2017\/03\/dashboards-vs-security-really-helping\/","title":{"rendered":"Dashboards vs Security – are they really helping?"},"content":{"rendered":"

Metrics, Dashboards and Security<\/h2>\n
\"Example
Example Security Dashboards<\/figcaption><\/figure>\n

Like them or not, metrics are a fundamental part of every organisation. Security doesn’t get to a free pass.\u00a0It is a rare CISO who doesn’t demand dashboards showing how all the security controls are performing. Therefore for most organisations, this is a fight long lost. This may not always be a bad thing either.<\/p>\n

Really, dashboards are a good way of showing metrics. Metrics themselves aren’t inherently evil. As a result, you’d think dashboards would enhance your infosec work.<\/p>\n

However, all to often the opposite is true. Metrics end up collected just for the sake of it. As a result, dashboards end up being nice shiny things for people to stare at. This is not good.<\/p>\n

What do you mean?<\/h2>\n

First off, an example to explain this.\u00a0Two of the most common metrics collected in security are patching and anti-virus status. Both are generally good things so people want to measure them.\u00a0As a result,\u00a0these are often\u00a0cited in security guidance – such as CSO Online’s article<\/a>. While this seems like a great idea it has problems.<\/p>\n