Your company Fleetwings has recently acquired FlyByNet Dispatchers, a small Internet wholesaler – retailer that serves a different set of aviation customer needs for products and services. That means that as the two companies merge together, your company not only inherits the strengths of that smaller Internet business — it also inherits any of its exploitable vulnerabilities, its process flaws, and any other weaknesses.
You’re trying to think one step ahead of your boss; you think she’s probably going to ask you next for a set of information security management metrics that cover FlyByNet Dispatchers’ operations, as a way of managing the M&A (mergers and acquisition) risks involved with this new member of the corporate family.
At the moment, you don’t know much about how that business operates, and probably know even less about its information systems, assets, and the architecture of hose systems and the business logic that they support. That’s okay. It’s still worthwhile to develop a starter set of information security metrics about that organization, its systems, and its processes.
You’ll just have to make some assumptions about how they do what they do, and what stuff (information, hardware, software, clouds, networks, people, or other) they use to get it done with.
Develop two sets of metrics
One set of metrics would be business process related; such as web site hits, rate of converting browsers or visitors into customers, or how often customers complain of product or service quality.
The other set would be systems and infrastructure related measurements, that might look at hardware or software systems health, data traffic, security monitoring systems, etc.
For each metric, you’ll need to gather your first thoughts, assumptions, estimates, or ideas as follows:
The name of the metric
“Business normal” for that metric: does the value of the metric (the measurement that “the metric” as an instrument produces) remain relatively flat throughout the business day, week, or year? Does it have patterns of peaks and troughs that probably relate to business activity? Does it usually trend in one direction or the other?
“Alarm conditions” for that metric: what kind of changes in the value of the metric should be used as alarms to incident response teams, security specialists, or others?
Alarm Meaning: what would such an alarm (or out-of-normal measurement) possibly mean to the company, either about a business process or a systems and infrastructure element?
Metric user: who uses this metric, either for routine monitoring, or for alarm response?
You’ll probably find using a table or spreadsheet helpful in organizing and presenting this data. Add a short narrative section (either in a separate Word file, comments, or text cells in the spreadsheet) to briefly state your assumptions.
One final question, which you should address in a brief narrative (Word, text block, or comment): what questions do you need answers to, or what things or topics would you need to know more about?
Sample Answer
Business Process Metrics:
Web Site Hits
Business Normal: This metric is expected to have patterns of peaks and troughs throughout the day and week, with higher traffic during business hours and lower traffic during non-business hours.
Alarm Conditions: A significant decrease in web site hits compared to the normal pattern could indicate potential issues with the website’s availability or marketing efforts.
Alarm Meaning: A sudden drop in web site hits could potentially mean that the website is facing technical difficulties or that the marketing strategies are not effectively reaching the target audience.
Metric User: Marketing team, web developers, and IT support.
Conversion Rate
Business Normal: The conversion rate is expected to fluctuate based on marketing campaigns, website improvements, and customer trends. It may show variations throughout the day, week, or year.
Alarm Conditions: A significant decrease in the conversion rate compared to the normal pattern could indicate issues with the user experience, payment gateway, or product/service quality.
Alarm Meaning: A decline in the conversion rate could imply that customers are facing difficulties in making purchases or that the product/service is not meeting their expectations.
Metric User: Sales team, marketing team, and customer support.
Customer Complaints
Business Normal: The number of customer complaints may vary based on product/service quality and customer satisfaction. It may have periodic spikes or remain relatively flat depending on the business activity.
Alarm Conditions: A sudden increase in customer complaints beyond the normal range could indicate potential issues with product/service quality, customer support, or delivery.
Alarm Meaning: A significant rise in customer complaints suggests dissatisfaction with the company’s offerings, which could harm its reputation and lead to customer churn.
Metric User: Customer support team, quality assurance team, and management.
Systems and Infrastructure Metrics:
Hardware/Software System Health
Business Normal: The system health metrics should remain stable throughout the day unless there are scheduled maintenance activities or unexpected hardware/software failures.
Alarm Conditions: Any anomalies in the system health metrics, such as high CPU/memory usage or frequent crashes, should trigger alarms for the IT support team.
Alarm Meaning: Alarms related to system health indicate potential performance issues, hardware/software failures, or security breaches that require immediate attention.
Metric User: IT support team, system administrators, and network engineers.
Data Traffic
Business Normal: Data traffic may vary based on business hours, marketing campaigns, or seasonal factors. It is expected to have peak periods and lower periods during non-business hours.
Alarm Conditions: Sudden spikes in data traffic beyond the normal range could indicate potential cyberattacks or unauthorized access attempts.
Alarm Meaning: Alarms related to abnormal data traffic could suggest ongoing security incidents, such as DDoS attacks or data breaches.
Metric User: Network security team, IT operations team, and security analysts.
Security Monitoring Systems
Business Normal: The security monitoring systems should be consistently active throughout the day, ensuring continuous monitoring of potential security threats.
Alarm Conditions: Any detected anomalies or suspicious activities within the security monitoring systems should trigger alarms for the security operations team.
Alarm Meaning: Alarms related to security monitoring systems indicate potential security breaches, malware infections, or unauthorized access attempts that require immediate investigation.
Metric User: Security operations team, incident response team, and IT security personnel.
Assumptions and Further Information Needed:
Assumptions:
FlyByNet Dispatchers’ business operations are similar to other online aviation wholesalers-retailers.
The company utilizes a website to attract and convert customers.
They have hardware and software systems to manage their operations.
Security monitoring systems are in place to protect their assets.
Further Information Needed:
Specific details about FlyByNet Dispatchers’ business processes and customer journey.
The architecture of their information systems and infrastructure.
The existing security measures and protocols implemented by FlyByNet Dispatchers.
Any known vulnerabilities or past security incidents within FlyByNet Dispatchers’ operations.
