  Risk is the best known and perhaps the best studied example within a much
broader class of cyber security metrics. However, risk is not the only possible
cyber security metric. Other metrics such as resilience can exist and could be
potentially very valuable to defenders of ICS systems. Often, metrics are
defined as measurable properties of a system that quantify the degree to which
objectives of the system are achieved. Metrics can provide cyber defenders of
an ICS with critical insights regarding the system. Metrics are generally
acquired by analyzing relevant attributes of that system. In terms of cyber
security metrics, ICSs tend to have unique features: in many cases, these
systems are older technologies that were designed for functionality rather than
security. They are also extremely diverse systems that have different
requirements and objectives. Therefore, metrics for ICSs must be tailored to a
diverse group of systems with many features and perform many different
functions. In this chapter, we first outline the general theory of performance
metrics, and highlight examples from the cyber security domain and ICS in
particular. We then focus on a particular example of a class of metrics that is
different from the one we have considered in earlier chapters. Instead of risk,
here we consider metrics of resilience. Resilience is defined by the National
Academy of Sciences (2012) as the ability to prepare and plan for, absorb,
recover from, or more successfully adapt to actual or potential adverse events.
This chapter presents two approaches for the generation of metrics based on the
concept of resilience using a matrix-based approach and a network-based
approach. Finally, a discussion of the benefits and drawbacks of different
methods is presented along with a process and tips intended to aid in devising
effective metrics.
