Metrics and Analysis in Security Management - Ohlhausen Research

Even before major problems occur, MA can be used to watchindicators—signs of risk—that may suggest a need for differentsecurity measures. Campbell (2006b) notes that these indicatorsor metrics “become the earliest prompts for more in-depth analysisof trend dynamics,” allowing CSOs to “look at the root causes ofproblems, not just the symptoms.” He lists several trends thatmetrics may help identify:METRICSPROVIDEANSWERS• More frequent or more severe accidents, crimes or policyinfractions;• Increased downtime of critical equipment;• Rise in negative background investigations;• Changes in security response times;• Reduction in building evacuation exercises; and• Rise in misconduct cases within a business unit.With careful analysis of the right metrics, a security professionalcan devise appropriate strategies to reduce risks. Expanding onthe example of increased misconduct cases, Campbell (2006b)suggests that further investigation might show poor supervisionof employees in that unit, as well as little employee awareness ofcompany policies on business conduct. Solutions would requireefforts by the security, human resources and legal departments.MA can also be used for external comparisons—that is, comparingone organization’s security-relevant metrics to those of otherorganizations. This process of benchmarking depends on theavailability of metrics and, of course, the underlying data thatmust be collected to produce those metrics.Metrics as Marketing for theSecurity ProgramIn their definition of security metrics management, Kovacichand Halibozek (2005) emphasize both the operational aspects ofmetrics (discussed above) and the business aspects of metrics. Onthe business side, they note:Consider this: Does yourmanagement want to beable to clearly see whetheryou are conforming withcorporate values andpolicies? Would they like tohave a visual representationof the state of the company’srisk—desirable orundesirable? Would theylike to have measurementsand data at hand that showwhether the company is incompliance with applicablelaws and regulations? Dothey want to know whetherpast and current securityinvestments have resultedin decreased risk or fewerincidents, so they canmore easily determinethe direction of futureinvestment?Through the use of metrics, the security cost versus benefitanalysis becomes more quantitative and easier to understand andcommunicate in common business terms. Metrics help the securityprofessional and others better understand the efficiency andeffectiveness (value) of an assets protection program.(Campbell & Blades, 2009)14 Metrics and Analysis in Security Management