What should be monitored and reported?
Both the internal and external use of security parameters require evidence and should help in stating the quantification of security factors. One needs to ensure the right terminology of security parameters. Listed are some of the key parameters around which security metrics need to be captured. It will be valuable to ensure that parameters capture two main dimensions: the severity and impact of the incidence.
Application security/vulnerability management
Application security encompasses measures throughout the code's life cycle to prevent gaps in the security policy of an application or the underlying system (vulnerabilities) through flaws in the design, development, deployment, upgrade, or maintenance of the application.
- Vulnerability: A weakness of the (sub)system, which can be exploited for impairing its services or affecting its assets
- Threat: A potential for violation of security, which exists when there is an action or event that could breach...
