Explain like I'm five · Security

What are Security Metrics?

Security metrics — MTTD, MTTR and friends — told as a story about a guard who answers the king's 'is our castle safe?' with numbers instead of feelings.

is our castle safe?um… I think so?the guard answers by feelTODAY'S FEELINGit was quietthe bell rang a bitprobably fine?feelings differ from person to personanswering 'is it safe?' with 'probably' fixes nothing

The king asks: is our castle safe? The guard answers by feel."Probably" fixes nothing. Feelings differ from person to person, and you can't compare yesterday with today.

100dthe thief was inside for a hundred daysnobody knewthe bell rings a hundred times a day — all catsthe real ring gets lostnoticed too late, ringing too much — without measuring, you see neither

Without measuring, you don't notice a thief inside for a hundred days — or a bell ringing a hundred times a day.Thieves stay hidden for a long time (dwell), and the bell rings too often because of cats (the big screen). Neither shows until you count.

time until noticedtime until chased oute.g. 30 dayse.g. 2 daysthief gets inthe bell ringschased outnumbers, not feelings — how fast we notice, how fast we chase outmeasure these two times and you can see the castle improve

Security metrics are numbers instead of feelings: how fast we notice, how fast we chase out.From the thief getting in to the bell ringing; from the bell to the thief being out. Measure just these two and you can see the castle improve.

Time to noticedays from break-in to bell
Time to chase outfrom the bell to the door shut
Cat ratiofalse rings out of all rings
Days waiting for boardsfrom finding a crack to fixing it
month by month — days until noticed30dJan24dFeb15dMar9dApr5dMay3dJunOTHER NUMBERScat rings: 90% → 40%board wait: 60d → 14dopened fake letter: 30% → 8%rooms with a dog: 60% → 95%all written down monthlywhen the bars go down, the castle is getting better

Draw the graph every month. When the bars go down, the castle is getting better.Board wait is the book of cracks, opened fake letters is the thief lesson, rooms with a dog is the guard dogs. Each number lights up one pillar.

the numbers improved, so did the castlenow 'safe?' gets a number for an answerARE WE DOING WELLnoticed in 3 dayschased out in a dayIS DANGER GROWING40 open cracks30% opened fake lettersgreen sign: our skillred sign: the danger aheadread both signs together to know how the castle really is

There are two kinds of sign: are we doing well, and is danger growing.The green sign is our skill; the red sign is the danger ahead. The five pillars tell you which numbers to measure.

In one breath

Security metrics = answering "is it safe?" with numbers, not feelings: time to notice, time to chase out, the cat ratio among rings, days waiting for boards. Measure monthly — when the bars go down, the castle is getting better.

Security metrics measure the state of security in numbers: MTTD (mean time to detect), MTTR (mean time to respond/recover), dwell time, false-positive rate, patch SLA compliance, phishing click and report rates, coverage. KPIs show how well our work performs, KRIs show growing risk — and both are read as trends.

When grown-ups say it

MTTD (Mean Time to Detect)
From the thief getting in to the bell ringing. Count the average days. Shorter is better.
MTTR (Mean Time to Respond)
From the bell to the thief being out. A better book of steps makes it shorter. → the book for when a thief gets in
Dwell time
All the days the thief was inside. Goes down when you go looking instead of waiting for the bell. → the watchman who doesn't wait
False positive rate
The cat ratio. How many rings were false. Tuning the rules brings it down. → the guard room's big screen
Patch SLA
The promised wait for boards. How many days you promised to fix a crack within, and whether you kept it. → the monthly book of cracks
Click rate, report rate
Who opened the fake letter, who reported it. Openers should fall and reporters rise. → the thief lesson
Coverage
The share of rooms with a dog. You can't guard a room you don't know about. → a dog in every room, counting doors from outside
KPI vs KRI
The green sign and the red sign. KPI is our skill (performance), KRI is growing risk. Read both. → the risk scale
Next story
The Island Shed With No Bridge →
Want another term as a picture book? Request →