Risk: A Good System Security Measure

What gets measured gets done. Security engineering as a discipline is still in its infancy. The field is hampered by its lack of adequate measures of goodness. Without such a measure, it is difficult to judge progress and it is particularly difficult to make engineering trade-off decisions when designing systems. The qualities of a good metric include that it: (1) measures the right thing, (2) is quantitatively measurable, (3) can be measured accurately, (4) can be validated against ground truth, and (5) be repeatable. By "measures the right thing", the author means that it measures some set of attributes that directly correlates to closeness to meeting some stated goal. For system security, the author sees the right goal as "freedom from the possibility of suffering damage or loss from malicious attack." Damage or loss applies to the mission effectiveness of the information infrastructure of a system. The mission can be maximizing profits while making quality cars or it could be defending an entire nation against foreign incursion