Key Performance Metrics | Secure x Design

Wiki > Key Performance Metrics

KPI	Metric Category	KPI Definition/Reasons for measurement.	Board	Executive Management	Middle Management	Operational Management
Source of Incidents Created	Security Incidents	Defines the sources of incident detection or reporting e.g Phone, DNS, Proxy and DHCP
Time Duration between Event Detected and Incident Record Created	Security Incidents	Time between when the event was detected in SIEM and when the Incident record was created
Time Duration between Incident Acknowledgement and Incident Containment	Security Incidents	The time between Incident Acknowledgement and its containment.
Time duration between event detected and incident contained	Security Incidents	This is the overall circle from Event detection to Incident Containment. Incident Resolution Time. Average time for resolving an incident grouped into categories
Incident False Positive %	Security Incidents	Displays the percentage of incidents recorded that were identified as False Positives later on
Incident % handled purely at L1	Security Incidents	The percentage of incidents handled at L1. It could be said to be First Time Resolution Rate. Costs is low if this is sorted at L1 level. Target for this metric is usually >= 80%.
Incident % Escalated from L1 to L2	Security Incidents	The percentage of incidents escalated from L1 to L2 within the SOC distributed by week.
Incident % Escalated from L2 to L3	Security Incidents	The percentage of incidents escalated from L2 to L3 within the SOC distributed by week.
Incidents Created & Closed	Security Incidents	Counts of Incidents Created & Closed over time (typically per week)
Incident Status Count	Security Incidents	Total Incident Count by Status. It is the Incident Count based on following Status: New, Assigned, In Progress, Escalated, Returned to Level 1, Remediation Requested, Remediation in Progress, Remediation in Completed, Resolved.
Incident Count by Subsidiary	Security Incidents	Distribution of Incidents laid out by subsidiary on weekly basis.
No. of Total Investigation by Subsidiary	Security Incidents	No. of Total Investigation by subsidiary
No. of Total Breaches by Subsidiary	Security Incidents	No. of Total Breaches by subsidiary
Number of Breaches by Status	Security Incidents	Number of Breaches by Status
Number of Breaches by Time	Security Incidents	Number of Breaches by Time
Number of Incidents by Time	Security Incidents	Number of Incidents by Time
Number of Investigations by Time	Security Incidents	Number of Investigations by Time
Incident count by source operating system	Security Incidents	Incident count by source operating system
Number of Incidents by Priority	Security Incidents	Number of Incidents by Priority: P1, P2, P3 and P4. Gives a snapshot of where we are at per time
Number of Investigations by Priority	Security Incidents	Number of Incident Investigations by Priority: P1, P2, P3 and P4. Gives us a count of Incidents found versus Incidents being investigated
Incidents by Confirmation	Security Incidents	Incidents by Confirmation: Confirmed, Suspected and False Positive
Number of Incidents by Status	Security Incidents	Number of Incidents by Status
Number of Investigations by Status	Security Incidents	Number of Investigations by Status
New Incidents by Week	Weekly Security Trends	New Incidents by Week. Gives a count of New Incidents by week for comparison on how many we get over time
Incident Trend by Status – Weekly	Weekly Security Trends	Weekly Incident Trend by Status: New, Assigned, In Progress, Escalated, Returned to Level 1, Remediation Requested, Remediation in Progress, Remediation in Completed, Resolved. Gives a summary of Incidents by Status for weekly comparisons
Incident Trend by Priority – Weekly	Weekly Security Trends	Weekly Incident Trend by Priority: P1, P2, P3 and P4
Weekly Average time to escalate	Weekly Security Trends	Weekly Average time to escalate incidents
Weekly Average time to close	Weekly Security Trends	Weekly Average time to close incidents
Weekly trend of false positives	Weekly Security Trends	Weekly trend of false positives
Lessons learned • most valuable mistake • conversion rate	Weekly Security Trends	Lessons learned • most valuable mistake • conversion rate
Intelligence types • value by volume • value by severity	Weekly Security Trends	Intelligence types • value by volume • value by severity
Count of Use Case usage (how often each use case is executed)	Accuracy of Rules	Count of Use Case usage (how often each use case is executed)
Use Case kills	Accuracy of Rules	Use Case kills
Use Case false positives	Accuracy of Rules	Use Case false positives
Control Efficacy	Accuracy of Rules	The efficacy of the detection based on the invocation of the Content rules. Display top 10 content rules triggered for the Subsidiary – few samples below: ■ Resulting Alert Classification ■ Resulting Alert Category ■ Assets targeted
Incidents distribution by Threat Category • Social: Phishing • Malware: Unknown • Malware: C2 • Hacking: Footprinting • Hacking: Brute force • Hacking: Abuse of Functionality	Threat Metrics	Insights into the subsidiary incident profile for the last week/month distributed by the assigned Incident Categories (Malware, C2, etc.) including incident prioritization (P1, P2, etc.)
Incidents by Attack Vector	Threat Metrics	Incidents by Attack Vector
Incidents by Target types	Threat Metrics	Incidents by Target types
Attacker objective	Threat Metrics	Attacker objective
Tactics, Tech. & Procedures	Threat Metrics	Tactics, Tech. & Procedures
Incidents by Business	Business & Breach Metrics	Incidents by Business
Incidents by Facility	Business & Breach Metrics	Incidents by Facility
Incidents by Asset Criticality	Business & Breach Metrics	Incidents by Asset Criticality
Incidents by Business Impact	Business & Breach Metrics	Incidents by Business Impact
Breach by Business Impact	Business & Breach Metrics	Breach by Business Impact
Breach Notification Status	Business & Breach Metrics	Breach Notification Status
Breach Task Status	Business & Breach Metrics	Breach Task Status
Types of Data Breached	Business & Breach Metrics	Types of Data Breached
Actors: Origin	VERIS Based	Defines the geographic distribution of the attack/incident e.g. China, Russia etc
Actors: Motive (is this measurable?)	VERIS Based	Defines the motive behind the attack/Incident e.g. Fun, Fear, Grudge etc.
Actions: Vector	VERIS Based	Defines the vector of the attack/incident as per the VERIS classification e.g. Email, IM, Direct Install, Remote Injection etc.
Actions: Malware	VERIS Based	Defines the distribution of the variety of malware used as per the VERIS classification of the incident e.g. RAT, Dropper, DoS, adware etc.
Actions: Hacking	VERIS Based	Defines the distribution of the type of hacking attack used as per the VERIS classification e.g. LDAP, XSS, Cache etc.
Asset: Management	VERIS Based	Defines the distribution of the asset management (asset managed by which part of the business or a third party) as per the VERIS classification of the incident.
Attributes (Variety)	VERIS Based	Defines the distribution of the incidents by the platform per the VERIS classification e.g. Iphone, Win7, Win2008 etc.
Kill Chain	VERIS Based	Attack penetration by Cyber Kill Chain (delivery, exploit, install, C2, Exfil). A kill chain is a systematic process to target and engage an adversary to create desired effects. It Basically tells us at what stage we capture an attack. The stages are: Recon>Weaponization>Delivery>Exploitation>Installation>Command & Control (C2)>Actions on Objectives
Incident Queue by Analyst ID	Analyst Workload	Insight into the workload of Analysts to help SOC capacity planning. E.g. Incidents handled by all L1/L2 Analysts
Incident Queue by All Analysts	Analyst Workload	Incidents handled by All Analysts based on Incident Status: New, Assigned, In Progress, Escalated, Returned to Level 1, Remediation Requested, Remediation in Progress, Remediation in Completed, Resolved.
Analyst incident Count sent back	Analyst Workload	Analyst incident Count sent back
Overhead costs per analyst and incident	Analyst Workload	Overhead costs per analyst and incident
Average Time to Acknowledge	Triage	Depicts the average time to acknowledge a task in one hour intervals over the previous 24 hour reporting period with incident priority categorization.
Average Time to Close	Triage	Depicts the average time to close a task in one hour intervals over the previous 24 hour reporting period with incident priority categorization.
Closure Rate	Triage	Depicts the task closure rate in one hour intervals over the previous 24 hour period with incident priority categorization.
Incident Rate	Triage	Depicts the incident rate in one hour intervals over the previous 24 hour reporting period with incident priority categorization.
Last Modified Tasks	Triage	Depicts the most recently modified task entries with incident priority categorization.
Longest Open Tasks	Triage	Depicts the tasks that have been open for the longest amount of time with incident priority categorization.
Longest Unacknowledged Tasks	Triage	Depicts the tasks that have been unacknowledged for the longest amount of time with incident priority categorization.
Open Tasks by Owner	Triage	Depicts the number of open tasks for each unique owner contained in the Task Triage database with incident priority categorization.
Open Tasks by Priority	Triage	Depicts the percentage of open tasks by priority level with incident priority categorization.
Tasks by Priority and Owner	Triage	Depicts the number of open items by priority for a specified user with incident priority categorization.
Top 10 Source Addresses of Alarms	Incidents (Correlated Sources)	Displays the top 10 source addresses of intrusion detection alarms.
Top 10 Alarms	Incidents (Correlated Sources)	Displays the top 10 alarms by signature ID that have been generated.
Top 10 Destinations of Alarms	Incidents (Correlated Sources)	Displays the top 10 destination IP addresses that have been targeted for attack.
Top 10 Requested URL/FTP Destinations	Incidents (Correlated Sources)	Displays the top 10 URL or FTP destinations requested by internal users.
Top 20 Bandwidth Ports	Incidents (Correlated Sources)	Displays the 20 ports with the most bandwidth usage.
Top 20 Bandwidth Users	Incidents (Correlated Sources)	Displays the top 20 bandwidth users.
Top 20 Connections by Address	Incidents (Correlated Sources)	Displays the top 20 users of connections.
Top 20 Connections by Port	Incidents (Correlated Sources)	Displays the 20 ports with the most connections.
Top 20 Denied Inbound by Address	Incidents (Correlated Sources)	Displays the top 20 foreign addresses that were denied inbound access.
Top 20 Denied Inbound by Port	Incidents (Correlated Sources)	Displays the 20 ports with the most denied connections.
Top 20 Denied Outbound by Address	Incidents (Correlated Sources)	Displays the top 20 local addresses that were denied outbound access.
Return-on-Investment	Future Metrics	This will be valid when the operational metrics are tied back to the Risk Profile and Business Impact Analysis provided by RSA Archer SecOps. It can help quantify how much potential cost saving has been made for both time and monetary terms due to mitigated incidents and/or timely response.
Compliance Posture	Future Metrics	RSA Archer SecOps can be capitalized to measure and report against the mandatory compliance requirements, however this will require further analysis and a wider stakeholder discussions to measure its viability and implementation.
Vulnerability Profile	Future Metrics	Vulnerability profile can be reported against as the corresponding details are gradually shared by the subsidiary. Common reporting areas are:
Vulnerability Profile: Least Recently Scanned	Future Metrics	Lists assets in order of the longest duration since last scan.
Vulnerability Profile: Most Vulnerable Assets by Business Rating	Future Metrics	Lists the assets in order of business rating and the aggregate vulnerability severity score.
Vulnerability Profile: Most Vulnerable Assets by Count	Future Metrics	Lists the assets in order of the number of vulnerabilities associated with an asset.
Vulnerability Profile: Most Vulnerable Assets by Severity	Future Metrics	Lists the assets in order of the aggregate vulnerability severity score.
Vulnerability Profile: Vulnerability by Severities	Future Metrics	Depicts the detected vulnerabilities as a percentage of the total organized by severity value.
Number of implemented Preventive Measures/Rules	ITIL KPIs Information Security Management	Number of preventive security measures which were implemented in response to identified security threats
Implementation Duration	ITIL KPIs Information Security Management	Duration from the identification of a security threat to the implementation of a suitable counter measure
Number of major Security Incidents	ITIL KPIs Information Security Management	Number of identified security incidents, classified by severity category
Number of Security-related Service Downtimes	ITIL KPIs Information Security Management	Number of security incidents causing service interruption or reduced availability
Number of Security Tests	ITIL KPIs Information Security Management	Number of security tests and trainings carried out
Number of identified Shortcomings during Security Tests	ITIL KPIs Information Security Management	Number of identified shortcomings in security mechanisms which were identified during tests
Total Number of RFCs raised	ITIL KPIs Change Management	Number of major changes assessed by the CAB (Change Advisory Board)
Percentage for each Change Category	ITIL KPIs Change Management	Shows Routine, Standard, Expedited and Emergency change percentages
Number of successful changes	ITIL KPIs Change Management	Number of successful changes
Number of changes backed out	ITIL KPIs Change Management	Number of changes backed out
Number of failed changes	ITIL KPIs Change Management	Number of failed changes
Number of CAB Meetings	ITIL KPIs Change Management	Number of CAB (Change Advisory Board) meetings
Time for Change Approval/ Rejection	ITIL KPIs Change Management	Average time from registering an RFC with Change Management until a decision on the RFC is reached (i.e. until it is either approved or rejected)
Change Acceptance Rate	ITIL KPIs Change Management	Number of accepted vs. rejected RFCs
Number of Emergency Changes	ITIL KPIs Change Management	Number of Emergency Changes assessed by the ECAB (Emergency Change Advisory Board)
Number of Problems	ITIL KPIs Problem Management	Number of Problems registered by Problem Management grouped into categories
Problem Resolution Time	ITIL KPIs Problem Management	Average time for resolving Problems grouped into categories
Number of unresolved Problem	ITIL KPIs Problem Management	Number of Problems where the underlying root cause is not known at a particular time
Number of Incidents per Known Problem	ITIL KPIs Problem Management	Number of reported Incidents linked to the same Problem after problem identification
Time until Problem Identification	ITIL KPIs Problem Management	Average time between first occurance of an Incident and identification of the underlying root cause
Problem Resolution Effort	ITIL KPIs Problem Management	Average work effort for resolving Problems grouped into categories

Category: Reporting Templates