The available security technologies for any one application suite are multiple and mysterious, not to mention costly and sometimes inconvenient to the point of crippling. The confluence of several such suites in an integrated environment is not only common but mandated in the enterprise, and these suites are often difficult to evaluate for information security characteristics. Also, inconsistent terminology usage has complicated the development of IT metrics, such as rating , ranking , quantifying , or scoring measurements. The push to develop quantifiable measures of assurance is but one step in this progression. While the goals of this movement are laudable, the underlying science is sadly lacking.
Software development is, at best, in the craft era.
I would like to believe that metrics relating to security are possible, but there is little evidence to support this view at present. Debunk the pseudo-science associated with assurance metrics. Find some indirect indicators of security. Precisely define the research problems in developing IA metrics methodologies. Recap the latest thinking on current IA metrics activities.