MetriCon 4.0: The Importance of Context

Tuesday, August 11, 2009, Montreal, Quebec.
Meeting Digest, Dan Geer


Agenda

8:30am - 9:00am: Continental breakfast

1. Baseline Scoring Methods

• Reproducible Measurement as a Foundation for Security Assessment Metrics, John Nye
• Orbitz SCAP Metrics, Ed Bellis

2. Measuring Impact

• The Ugly, The Bad, and The Good, Lloyd Ellam
• Metrics for Detecting Compromised Systems, Shivaraj Tenginakai (paper)

3. Enterprise Security Management

• Security Metrics in Governance, Risk and Compliance, Li Liu
• Using Security Metrics to Motivate a Response to A Critical Vulnerability, Jim Cowie
• Foundational Practices that Optimize Security and Operations, Gene Kim
  

12:30pm - 2:00pm: Lunch over discussion of handouts, including:

• Measuring the future basis of competition among AV products
• Performance Testing the Vulnerability Response Decision Assistance (VRDA) Framework
• PCI DSS Statistics and Metrics
• Techniques for Enterprise Network Security Metrics
• CIS Consensus Project
• SOX Material Weakness and CIO/CEO turnover

4. Software Security

• The Building Security In Maturity Model, Gary McGraw & Brian Chess
• Does Software Quality Matter?, Sandy Clark & Matt Blaze

5. Trends and Stats

• Crunching Metrics from Public Data, Betsy Nichols
• Data Loss DB, David Shettler

6. Security Manager Panel

• Moderator, Jennifer Bayuk (overview)
• Panelists: Ed Bellis, Orbitz, Chris Walsh. SurePayroll, and Robert Masse, Reitmans Ltd.

6pm - ?: All attendees are invited to stay for further discussion over dinner


Original CFP

Attachments