  Technical security metrics provide measurements in ensuring the effectiveness
of technical security controls or technology devices/objects that are used in
protecting the information systems. However, lack of understanding and method
to develop the technical security metrics may lead to unachievable security
control objectives and incompetence of the implementation. This paper proposes
a model of technical security metric to measure the effectiveness of network
security management. The measurement is based on the effectiveness of security
performance for (1) network security controls such as firewall, Intrusion
Detection Prevention System (IDPS), switch, wireless access point, wireless
controllers and network architecture; and (2) network services such as
Hypertext Transfer Protocol Secure (HTTPS) and virtual private network (VPN).
We use the Goal-Question-Metric (GQM) paradigm [1] which links the measurement
goals to measurement questions and produce the metrics that can easily be
interpreted in compliance with the requirements. The outcome of this research
method is the introduction of network security management metric as an
attribute to the Technical Security Metric (TSM) model. Apparently, the
proposed TSM model may provide guidance for organizations in complying with
effective measurement requirements of ISO/IEC 27001 Information Security
Management System (ISMS) standard. The proposed model will provide a
comprehensive measurement and guidance to support the use of ISO/IEC 27004 ISMS
Measurement template.
