Believe it or not, we are down to our final metrics post! We’re going to close things out today with change management – something that isn’t specific to security, but comes with security implications.
Our change management process is:
- Monitor
- Schedule and Prepare
- Alter
- Verify
- Document
Monitor
Variable |
Notes |
Time to gather change requests |
Time to evaluate each change request for security implications |
Schedule and Prepare
Variable |
Notes |
Time to map request to specific actions/scripts |
Time to update change management system |
|
Time to schedule downtime/maintenance window and communicate |
|
Alter
Variable |
Notes |
Time to implement change request |
Verify
Variable |
Notes |
Time to test and verify changes |
Document
Variable |
Notes |
Time to document changes |
Time to archive scripts or backups |
Other Posts in Project Quant for Database Security
- An Open Metrics Model for Database Security: Project Quant for Databases
- Database Security: Process Framework
- Database Security: Planning
- Database Security: Planning, Part 2
- Database Security: Discover and Assess Databases, Apps, Data
- Database Security: Patch
- Database Security: Configure
- Database Security: Restrict Access
- Database Security: Shield
- Database Security: Database Activity Monitoring
- Database Security: Audit
- Database Security: Database Activity Blocking
- Database Security: Encryption
- Database Security: Data Masking
- Database Security: Web App Firewalls
- Database Security: Configuration Management
- Database Security: Patch Management
- Database Security: Change Management
- DB Quant: Planning Metrics, Part 1
- DB Quant: Planning Metrics, Part 2
- DB Quant: Planning Metrics, Part 3
- DB Quant: Planning Metrics, Part 4
- DB Quant: Discovery Metrics, Part 1, Enumerate Databases
- DB Quant: Discovery Metrics, Part 2, Identify Apps
- DB Quant: Discovery Metrics, Part 3, Config and Vulnerability Assessment
- DB Quant: Discovery Metrics, Part 4, Access and Authorization
- DB Quant: Secure Metrics, Part 1, Patch
- DB Quant: Secure Metrics, Part 2, Configure
- DB Quant: Secure Metrics, Part 3, Restrict Access
- DB Quant: Monitoring Metrics: Part 1, Database Activity Monitoring
- DB Quant: Monitoring Metrics, Part 2, Audit
- DB Quant: Protect Metrics, Part 1, DAM Blocking
- DB Quant: Protect Metrics, Part 2, Encryption
- DB Quant: Protect Metrics, Part 3, Masking
- DB Quant: Protect Metrics, Part 4, WAF
Reader interactions
One Reply to “DB Quant: Manage Metrics, Part 3, Change Management”
Who on earth is going to take the time to collect the data to derive these metrics from, and have you covered the basic fundamentals of metrics anywhere such as “easy to collect”? (If so, I’ve likely missed it in the deluge of posts in this category) Maybe I’m missing something, but where is the value in these metrics that will drive me to go to that effort?
I wish that you would focus more on how to select metrics that will gain executive attention and actually drive the security program forward rather than this very detailed listing of technical metrics that seem to be devolving into navelgazing.