A survey of security metrics use in some Finnish organizations

Information security metrics can be used to resolve the security level in a product, process, system or organization. In this study, the use of information security metrics in certain Finnish organizations is studied by analyzing eight interviews conducted in industrial companies and State institutions. The results of the interviews show that measuring information security is considered important, but the benefits of such measurements can only be seen when the use of metrics is applied as a process, with the experience gained from the use of history data. The problem is often in the utilization of the results. There is a need for standards and tools that enable measuring individual expertise as well as to automate and rationalize the measurements. The most beneficial metrics are quantitative as well as proactive.