Measuring the effectiveness of a detection engineering program
While efficiency is a measure of productiveness, effectiveness is a measure of success. How well is the detection engineering team actually helping to achieve the SOC’s goals, which should have a direct correlation to the value the organization provides? Quantifying the value of a cyber security program is always difficult. The cost of a cyber-attack cannot be quantified until after it has occurred and the damage has been assessed. It is therefore difficult to quantify how much stopping an attack has saved the organization. Should the value of a cyber security organization be judged based on the number of attacks performed by adversaries? Should an attack attempt to steal a random user’s credit card number be counted the same as an advanced adversary attempting to steal the company’s intellectual property or hold it for ransom? Stopping thousands of indiscriminate phishing attacks may not matter as...