Metricon 2011 Summary

A conference recap highlighting sessions from Metricon and broader security events: Wendy Nather’s guidance on designing meaningful security metrics; Josh Corman’s critique of stagnation in security practices and PCI’s unintended effects; Jake Kouns’s overview of cyber-liability insurance and its incentives; and Allison Miller and Itai’s applied risk analytics workflow culminating in automated decisions for detecting account takeovers. The author finds the metrics-driven, defensive focus refreshing and encourages moving beyond the “hamster wheel of pain.”