Quality factors in McCall’s model affect product operation , translation or revision . These are similar to architectural quality attributes–a measurable or testable property of a system used to indicate how well the system satisfies the needs of its stakeholders. Basili’s GQM cites McCall’s model and identifies it as another means of defining Software Quality Metrics.
That model takes quality criteria coupled with metrics collected throughout the lifecycle to provide feedback on quality. What’s missing from this model is a what is goal question metric discussion on how to arrive at good metrics. The metrics or measurements that are collected are then used to answer the questions in a quantifiable manner.
A Simple Framework for Identifying the Real User Problems
I like this framework when its coupled with the quality criteria in McCall’s model. What follows is a brief description of GQM and how I think it complements McCall’s model. Determine actions that most effectively improve the metrics.
This paper discusses the Goal-Question-Metrics approach and its application towards constructing measurement items for a security metric. It also attempts to provide practical guidance and example of measurements using GQM. An application of the GQM paradigm towards the development of a security metric is presented.
Questions (operational level): How will this initiative achieve its goals?
This book is holistic and I strongly believe it will help to bridge the gaps we have today. An organization must identify goals and trace those goals to data intended support to those goals operationally. Then provide a framework for interpreting the data with respect to its goals. The ‘Goal Question Metric’ approach is commonly used to improve and measure software quality, but it can also be applied to cybersecurity.
Let’s revisit the Key Results of the “Minnesota Innovation” OKR example. Why is it essential to place Minnesota on the State Technology and Science index? Why do we aim to increase the number of innovative businesses, https://www.globalcloudteam.com/ etc. by 25%? Why do we want to double technology training for job seekers? OKR’s Key Results omit many crucial questions that could have been asked, perhaps even critical aspects of the objective.
Improve your Coding Skills with Practice
At the end of this talk, the audience will understand, not only how to ask the right questions, but specifically what metrics can be used to answer them. What makes a good metric is a subject for a future post and don’t underestimate the difficulties in picking metrics that provide a meaningful measure of security performance. However, keeping the objective in mind and selecting a set of questions that are meaningful to the CISO helps security teams focus on what really matters. In trying to determine what to measure in order to achieve those goals, I recommend using a Goal-Question-Metric paradigm. It can actually be applied to all life-cycle products, processes, and resources. I’ve been using this process for years and it really helps me create a quality metric, independent of the processes lifecycle.
The easiest way to find out whether you have answered your question is to see whether you can demonstrate positive, or at least definitive, business results. A detailed analysis of how I code provided insight on poor practice. Measurement also helps, during the course of a project, to assess its progress, to take corrective action based on this assessment, and to evaluate the impact of such action. To find this, James would scan the network, see what IP addresses are there, pick up the MAC address through the switch tables, and then see which of those are recorded in the inventory. We are continuing to explore this framework and possible extensions to it and will report on the success of this work in future posts.
GQM helps you answer key business questions
“Improve Company Website” Goal and QuestionsEach of these questions should be constructed to accommodate a numeric or Yes/No value. As with OKR’s Key Results, GQM’s Questions must be converted into feasible targets. This can be done by taking baseline measurements for each question, which you will then seek to improve.
GQM’s approach is to ask wide-ranging questions about a Goal. This makes it more holistic and complete than OKRs or at least, a way to select higher impact Key Results. To see how Panaseer can automate your security measurement, get in touch or book a demo. The object here is the security documentation and the goal is improvements in effectiveness of on-boarding new joiners. James Blake is the co-founder and director of Security B-Sides London, former-CISO at Mimecast and currently Field CISO at Rubrik, and not to mention an expert in cybersecurity measurement.
Share this paper
Ideally you would have a few, maybe five, but even one quantitative metric aligned to your goals and questions can be beneficial. The Goal Question Metric approach, or “GQM”, is an approach to software metrics that improve and measure the quality of software. Goals Question Metric approach is combined with other approaches to analyze whether goals can be achieved or not. Organizations like NASA and Motorola have used the GQM approach to improve their processes and ensure that goals are achieved as per requirement. I don’t differentiate between the current notion of software architecture quality attributes and quality factors.
- James notes that many of the challenges around asset management are not technical, but cultural or political.
- The idea is to start with a high-level goal that expresses what you want to achieve or improve in terms of quality, such as usability, reliability, or performance.
- You establish goals for an initiative, considering the quality of that initiative from various perspectives and in a variety of contexts.
- Prashanth rightly believes and demonstrates that data is not an asset of the IT team and is an organization-wide asset.
This book is absolutely timely and relevant in today’s data-driven world. Most of the books on data available in the market today focus on data quality, governance, and analytics. This book from Dr. Prashanth Southekal is brilliant as it puts the business stakeholder at the center by addressing the key value propositions of the business user.
How to apply the GQM approach?
In case of cyber security, a good measure is ‘how effective are the security controls in reducing material risk ? ’ at a tactical level, ‘how many person-hours does it take to resolve a security incident ? Questions are then derived from the goals and help to refine, articulate, and determine if the goals can be achieved. Goal-oriented i.e., there has to be some rationale and need for collecting measurements, rather than collecting for the sake of collecting. Each measurement collected is stated in terms of the major goals.
