Belajar Security Architect - Security Metrics & Board Reporting
Mempelajari KRIs/KPIs security, security posture measurement, board-level reporting, dan metrics yang menggerakkan keputusan bisnis
#Pendahuluan
Setelah di episode 13 kita mempelajari security strategy & roadmap, pada episode ini kita dalami security metrics & board reporting — bagaimana mengukur efektivitas keamanan dan melaporkannya ke board. Metrics yang tepat mengubah security dari "feeling aman" menjadi "terbukti aman."
Mengapa metrics penting? Karena "kita tidak pernah kena breach" bukan metrics — itu keberuntungan. Board butuh data untuk membuat keputusan informed.
#KRIs vs KPIs
| Tipe | Definisi | Contoh |
|---|---|---|
| KRI (Key Risk Indicator) | Early warning risiko | # vulnerabilities high/critical |
| KPI (Key Performance Indicator) | Ukuran efektivitas | MTTD, MTTR |
#KRI Examples
| KRI | Target | Alert Threshold |
|---|---|---|
| Open critical vulnerabilities | < 5 | > 10 |
| Unpatched systems | < 2% | > 5% |
| MFA coverage | 100% | < 95% |
| Phishing click rate | < 2% | > 5% |
#KPI Examples
| KPI | Target | Benchmark |
|---|---|---|
| MTTD | < 1 hour | Industry avg 207 days |
| MTTR | < 4 hours | Industry avg 73 days |
| Alert-to-incident ratio | < 100:1 | - |
| Detection coverage (ATT&CK) | > 70% | - |
#Security Posture Measurement
#Scoring Framework
| Category | Weight | Metrics |
|---|---|---|
| Identity | 25% | MFA, PAM, lifecycle |
| Endpoint | 20% | EDR, patching, config |
| Network | 20% | Segmentation, monitoring |
| Cloud | 20% | CSPM, IAM, encryption |
| Data | 15% | Classification, DLP |
#Maturity Levels
| Level | Score | Description |
|---|---|---|
| Initial | 0-20% | Ad-hoc, reactive |
| Developing | 21-40% | Basic controls |
| Defined | 41-60% | Standardized |
| Managed | 61-80% | Measured, controlled |
| Optimizing | 81-100% | Continuous improvement |
#Board Reporting
#Board Report Template
Executive Summary:
- Overall security posture: 72% (Managed level)
- Critical risks: 2 (down from 5 last quarter)
- Major incidents: 0
- Compliance status: Compliant
Key Metrics:
- MTTD: 45 min (improved from 2 hrs)
- MTTR: 3.5 hrs (improved from 8 hrs)
- Patch coverage: 97% (target: 95%)
Top Risks:
1. Legacy system unpatched (remediation in progress)
2. Third-party vendor risk (assessment ongoing)
Recommendations:
1. Approve budget for XDR platform ($250K)
2. Hire 2 additional detection engineers
3. Schedule purple team exercise Q4Tip
Board report harus SINGKAT: 1 page executive summary. Include trend data (improving/declining) — board cares about trajectory, not just snapshot. Use visual (charts, traffic lights) over text.
#Communication by Audience
| Audience | Fokus | Format |
|---|---|---|
| Board | Risk, strategy, investment | 1-page summary |
| CISO | Program effectiveness | Dashboard |
| Engineering | Technical gaps | Detailed report |
Note
Security metrics harus telling a story. "MTTD is 45 minutes" means nothing without context — "MTTD improved from 2 hours to 45 minutes this quarter due to XDR investment" tells a story.
#Penutup
Inti yang harus dibawa pulang:
- KRIs = risk warning; KPIs = performance measurement.
- Posture score: Identity + Endpoint + Network + Cloud + Data.
- Board report: 1 page, trend data, visual format.
- Metrics harus telling a story, bukan sekadar numbers.
Di episode 15 selanjutnya kita akan membahas vendor & technology selection — evaluation frameworks, build vs buy, dan vendor risk management.