What are the most important security indicators to monitor?

Monitoring compliance indicators is essential for cybersecurity. Key areas include patch management, access controls, authentication, encryption, network security, incident response, training, vulnerability management, policy adherence, data backups, endpoint security, physical security, audit logs, regulatory compliance, and third-party risk. Regular assessments ensure timely updates, user reviews, encryption usage, network monitoring, incident response testing, and adherence to security policies. Compliance with industry regulations, timely incident reporting, and monitoring third party vendors contribute to a comprehensive cybersecurity posture, reducing risks and enhancing overall security.

There will be a theme to my responses. For true monitoring you need to test and monitor. Patch management is in part tested through vulnerability scans. Data segmentation should also be tested. You can have perfect controls in place, yet user error may end with PCI data where it shouldn't be.

Everything either it is infrastructure security or application or physical security, should be compliant. Compliance indicators should be taken seriously by security teams and stack holders. As an example in AWS there is a compliance manager which indicates compliance status. So if there is something which is showing as “non-compliant “ should be taken as serious issue by security teams.

If you have a number or severity of breaches it is unlikely you need a risk indicator. I would also state analyzing the dwell time or from detection to containment. Risk indicators are great, but it is hard to know weather the indicator actually means you have more risk. If you see an uptick in attempted attacks that your controls prevented then the inherent risk may increase while your residual risk remains the same. But to know whether that's true you'd need to test those controls. That specific indicator (numbernof attacks or incident investigations) is good mainly for you to answer the question of why it happened.

Value of what is protected and the value of reducing risk needs to be part of the conversation along with cost and return on investment. To speak to performance you need to know what uour security goals were/are. Testing, you need to test if you want to ensure the tools are assisting in meeting the goals.

I love the idea of measuring maturity, but none of those that are listed can be turned into a metric that is calculated. You'll likely need a maturity assessment, basically CMMI for security controls. I personally believe security programs vastly overstate the maturity of their control implementation. There is a world of difference between having a control and maturing it. Great example: a SIEM provides a specific control of retaining audit logs in a searchable format. That's a control (yes it is abbreviated with many details left out). How often do you review for systemsbthat are not logging? Does your SIEM resources (compute, storage, ) get included in incremental projects? Are the logs truncated? There is a lot of maturing to be done.