Certified Information Security Manager (CISM)Incident ManagementHard
A CISO is reviewing the organization's incident response metrics. The metrics currently track the number of incidents, average containment time, and cost per incident. To improve the overall effectiveness of the IR program, which additional metric would be MOST valuable for identifying systemic weaknesses and areas for strategic improvement?
- ANumber of security awareness training sessions conducted annually.
- BPercentage of incidents reported by external parties.
- CTotal number of security alerts generated per day.
- DMean Time To Detect (MTTD) incidents.
Show answer & explanationAnswer & explanation
Correct answer: D. Mean Time To Detect (MTTD) incidents.
MTTD directly measures the efficiency of detection mechanisms and processes. A high MTTD indicates delays in identifying incidents, pointing to weaknesses in monitoring, alert correlation, or initial analysis, which are crucial for strategic improvement of the IR program.
Why the other options are wrong
- A. Training sessions are a proactive measure, but don't directly measure the effectiveness of the IR program's detection or response.
- B. While important for external visibility, this metric indicates detection failure by internal means rather than overall detection efficiency.
- C. Total alerts can indicate volume but not necessarily detection efficiency or quality.
Mean Time To Detect (MTTD)
The average time it takes for an organization to identify a security incident from the moment it occurs.
- A crucial metric for evaluating the effectiveness of security monitoring and detection systems.
- Lower MTTD indicates a more mature and efficient detection capability.
- Directly impacts the overall incident response lifecycle, reducing potential damage.
Memory trick: Faster detection means less damage.