Proposing evaluation criteria for security effectiveness

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which is a measurable evaluation criterion for a security strategy?

A The system should be reasonably secure

B Fewer than 2 security incidents per year

2. Which criterion best measures AVAILABILITY?

A Systems are restored within 4 hours of an outage

B Only staff with approval can open payroll files

3. Which criterion best measures CONFIDENTIALITY?

A No unauthorised access to customer records in 12 months

B Website uptime of 99.9 percent

4. Which criterion best measures INTEGRITY?

A Backups are stored in two locations

B Fewer than 0.5 percent of records fail accuracy checks

5. A hospital sets the goal of keeping patient data private. Which criterion judges the strategy against that goal?

A Zero privacy breaches of patient records per year

B Staff must like the new security software

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Fewer than 5 security incidents per year		AZero unauthorised accesses to customer records per year
2Systems restored within 4 hours of an outage		BAt least 99.5% of records pass accuracy checks each month
3A criterion linked to confidentiality: it measures unauthorised access to private data		CA measurable evaluation criterion that sets a clear target for how often incidents may occur
4A criterion linked to integrity: it measures how accurate and unaltered the data is		DA measurable evaluation criterion for availability that sets a maximum recovery time
5Criterion: The system should be very secure		EIt is vague and not measurable. There is no number, time period or target, so the strategy cannot be judged against it.
6Criterion: Install a new firewall by June		FThis is an action or task, not a standard. It says what to do but not how to measure whether the strategy is working or meets organisational goals.

Definitions

evaluation criteria

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Criterion: Breaches per ____ <= 2

Criterion: Data entry errors <= 1% Links to: _________

Criterion: Unauthorised access = 0 a year Links to: _______________

Criterion: Recovery time <= 4 hours Links to: ____________

incidents = 3 target = 2 IF incidents __ target: "Met"

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Criterion: be more secure

B Target: 2 or fewer

C CIA link: confidentiality

Question 2

A Criterion: restore quickly

B Target: under 4 hours

C CIA link: availability

Question 3

A Criterion: uptime percentage

B Target: at least 99.9%

C CIA link: confidentiality

Question 4

A Criterion: record error rate

B Target: above 1% of records

C CIA link: integrity

Question 5

A Goal: protect customer records

B Criterion: unauthorised logins

C Target: zero per quarter

D CIA link: availability

Answer Key

Proposing evaluation criteria for security effectiveness

Section A: Quick Questions

B — Fewer than 2 security incidents per year

A — Systems are restored within 4 hours of an outage

A — No unauthorised access to customer records in 12 months

B — Fewer than 0.5 percent of records fail accuracy checks

A — Zero privacy breaches of patient records per year

Section B: Match the Pairs

Fewer than 5 security incidents per year → A measurable evaluation criterion that sets a clear target for how often incidents may occur

Systems restored within 4 hours of an outage → A measurable evaluation criterion for availability that sets a maximum recovery time

A criterion linked to confidentiality: it measures unauthorised access to private data → Zero unauthorised accesses to customer records per year

A criterion linked to integrity: it measures how accurate and unaltered the data is → At least 99.5% of records pass accuracy checks each month

Criterion: The system should be very secure → It is vague and not measurable. There is no number, time period or target, so the strategy cannot be judged against it.

Criterion: Install a new firewall by June → This is an action or task, not a standard. It says what to do but not how to measure whether the strategy is working or meets organisational goals.

Section C: Definitions

evaluation criteria — Measurable standards, such as incidents per year or recovery time, used to judge how well a security strategy meets its goals and protects confidentiality, integrity and availability.

Section D: Fill in the Blanks

Criterion: Breaches per year <= 2

Criterion: Data entry errors <= 1%
Links to: Integrity

Criterion: Unauthorised access = 0 a year
Links to: Confidentiality

Criterion: Recovery time <= 4 hours
Links to: Availability

incidents = 3
target = 2
IF incidents <= target: "Met"

Section E: Spot the Error

A — An evaluation criterion must be measurable. 'Be more secure' cannot be counted or compared. It should be a measurable standard such as 'Criterion: breaches per year'.

A — 'Restore quickly' is vague and has no unit. A criterion needs a measurable value, such as restore time in hours, so the strategy can be judged against the target.

C — Uptime measures whether systems and data can be accessed when needed, so it links to availability, not confidentiality.

B — An error rate target should be an upper limit. Aiming for more than 1% errors would reduce data integrity. It should be 'below 1% of records'.

D — Unauthorised logins measure whether people who should not see the data can get to it. That is confidentiality, not availability.