Hello,
I have been in IT Security for a number of years and I'm aware of multiple frameworks and standards representing security, but I'm struggling to find a usable method to provide a quantitative metric for the security posture of a firewall.
I would like to say "The firewall security is 96 % effective", for example ...
Is anyone aware of a mechanism to provide a meaningful and numeric representation to indicate the security effectiveness of a firewall ?
Thank you,
Rob.
Following. I'll be interested to hear responses.
@rlh wrote:I'm struggling to find a usable method to provide a quantitative metric for the security posture of a firewall. I would like to say "The firewall security is 96 % effective", for example ...
Interesting idea. What you might really be looking for is something like a "crossover error rate" where false accepts (traffic erroneously allowed) equal false rejects (traffic erroneously denied). The lower the crossover rate the more "effective" the firewall. I haven't seen that metric used. What's the scenario you see? Something like content filtering?