Measuring and Evaluating the Effectiveness of Information Security

State of information system security is described with the large number of features and indicators for different areas of information security. Depending on the area of a business in the company and the security objectives, for the effective security management it is necessary to select appropriate indicators and establish a process of their monitoring and measurement. Systematic application of such indicators is usually defined as a metric of standardized measures and methods of measurement and interpretation of results. Although in the literature we can found examples of such indicators and specific suggestions about how they collect and measure them, the whole area of the information security measurement is yet unexplored. The focus of this paper is to recapitulate past experience and results in the systematization and structuring of security indicators which is not completely clarified. The aim is to identify existing experiences concerning the application of security metrics as an instrument of evaluation and assessment of information system security.