Marcus Ranum

This episode is a bit of grab-bag of important points that didn't seem to fit anywhere else. Worse, some of it is going to...

In the preceding episode we looked at some stock charts that illustrate change in value over time. A time/value series is the metric you...

Figuring out what “normal” means is one of computer security's great challenges. Everyone seems to think that if we only knew what “normal” is,...

A friend of mine is a security manager at a university. He keeps metrics for fun, mostly, he says, to torture people with. His...

There are two ways to start establishing metrics. One is what I think of as the “bottom up” approach and the other being “top...

Warning: This section is going to be a bit “meta-” and it can't be helped. You can't talk about abstract meta-analysis any other way!

Keeping with the definition that a metric is used to tell a story, let's look at an influential metric and how it was established,...

When you start your metrics program, you will find that a great deal of information can be gleaned from existing data that gets stored...

There are many important and useful tools related to the metrics landscape; let's take a look at some of them and how they fit...

Most of the complex fields humans engage in develop their own terminology, which then becomes a problem of translation for the expert. One of...

This is the beginning of a series of postings I'll be doing on security metrics. It's a topic that I don't think we, as...