'The Metrics Manifesto'
Security professionals are trained skeptics. They poke and prod at other peoples digital creations, expecting them to fail in unexpected ways. Shouldnt that same skeptical power be turned inward? Shouldnt practitioners ask: How do I know that my enterpris