What might all this mean to Infosec? When we measure the amount of coverage a security mechanism has, we should also consider the readiness of the mechanism (and its administrators) to respond and defeat an attack. The mix of a quantitative metrics inside of a qualitative maturity or surety level can yield a more three dimensional model that maps more closely to reality.
your back closely or trying to cut a deal with insurgents," the official says."
Qualitative readiness levels are assigned to the battalions and police forces these qualtative assessments attempt to measure staff skills, training, equipment, communication, and sustainment.
counterinsurgency operations with some coalition support."
operations in conjunction with coalition units."
When we look at any number of infosec metrics like access control product's coverage in system, or patch levels, or scanning tool coverage, we are getting important, but insufficient data. These qualitative metrics need to put into a larger context that horizontally addresses the system properties to gauge resiliency for the system as a whole.
"horizontally addresses the system properties" and if I was sitting with a stack of metrics how could I practically achieve a horizontal guage of system resiliency?
When I use the term horizontal, I mean across domain. The domains may be databases, app servers, and web servers, for example. The purpose of horizontal approach is to syntehsize concerns across disparate domains.