<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="7.x">Drupal-Biblio</source-app><ref-type>27</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Veselin Monev</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Enterprise IT security metrics: Classification, examples and characteristics (in Bulgarian)</style></title><secondary-title><style face="normal" font="default" size="100%">IT4Sec Reports</style></secondary-title></titles><keywords><keyword><style  face="normal" font="default" size="100%">characteristics</style></keyword><keyword><style  face="normal" font="default" size="100%">classification</style></keyword><keyword><style  face="normal" font="default" size="100%">company</style></keyword><keyword><style  face="normal" font="default" size="100%">expected annual lose</style></keyword><keyword><style  face="normal" font="default" size="100%">incident</style></keyword><keyword><style  face="normal" font="default" size="100%">IT security</style></keyword><keyword><style  face="normal" font="default" size="100%">management</style></keyword><keyword><style  face="normal" font="default" size="100%">matrix</style></keyword><keyword><style  face="normal" font="default" size="100%">measure</style></keyword><keyword><style  face="normal" font="default" size="100%">Metric</style></keyword><keyword><style  face="normal" font="default" size="100%">metrics</style></keyword><keyword><style  face="normal" font="default" size="100%">Risk</style></keyword><keyword><style  face="normal" font="default" size="100%">Vulnerabilities</style></keyword></keywords><dates><year><style  face="normal" font="default" size="100%">2014</style></year><pub-dates><date><style  face="normal" font="default" size="100%">March 2014</style></date></pub-dates></dates><number><style face="normal" font="default" size="100%">111</style></number><publisher><style face="normal" font="default" size="100%">Institute of Information and Communication Technologies</style></publisher><pub-location><style face="normal" font="default" size="100%">Sofia</style></pub-location><language><style face="normal" font="default" size="100%">eng</style></language><abstract><style face="normal" font="default" size="100%">The report addresses the key issues associated with measuring IT security for private companies. Several classifications of metrics are discussed focusing on the functions of different levels of security management. For the most part, this work examines the pros and cons of common metrics for measuring IT security and provides guidelines for creating own metrics. ‘Own metrics,’ adapted to the corporate environment, are those which security managers have to create and use for the purpose of effective management.</style></abstract></record></records></xml>