Each quarter the security operations team reports the growing number of firewall rules to the steering committee as evidence that perimeter security is improving. The committee wants metrics it can use to make decisions. What is the PRIMARY weakness of this metric?
Select an answer to reveal the explanation.
Short Explanation
Counting firewall rules is like judging a restaurant by how many pans are in the kitchen: busy, sure, but is the food any good? More rules can actually mean more complexity and more risk. The trap is reporting effort; you want metrics that show whether risk is going down.
Full Explanation
Useful security metrics tell decision makers whether the program is achieving its objectives, which for a steering committee means whether risk to the business is moving toward an acceptable level. A rule count is an activity measure: it rises when the team adds rules, but says nothing about whether the rules are correct, necessary or reducing exposure. A growing rule base can even signal accumulated exceptions, overlapping entries and rising configuration risk, so the trend could be read in the wrong direction entirely. Collection frequency is not the problem; a quarterly figure is easy to produce, and reporting it more often would only repeat a meaningless number. Automation is also beside the point, since a figure that is trivial to collect is still worthless if it does not inform a decision. Disclosure of design detail is a legitimate handling concern for some reports, but an aggregate count reveals little and is not what makes the metric weak. Exam caveat: CISM consistently prefers effectiveness and outcome metrics over counts of work performed, especially for senior audiences. Operational check: for every metric on the committee report, ask what decision it supports and which business risk or objective it shows progress against; replace any that fail with measures such as unauthorized-exposure findings or time to remediate high-risk rules.