Unit 03 of 03
Program Management
Five lessons that measure every day between the annual snapshots: the gap between the incoming finding stream and remediation capacity in a vulnerability management program and the growth of the queue, the point where the exploited vulnerability and the unplanned outage intersect as the patch window narrows, the decay of awareness training gains by group and the retraining week, the gap between the exercise item that failed to hold and the target time versus the measured time, and finally the separation between the metric that changes behavior and the metric that only reaches the report.
Published Updated
Lessons
- 01 Vulnerability Management Program Against 884 findings arriving over 52 weeks, a weekly remediation capacity of 84 person-hours: a 13.2-hour gap leaves a 684-hour queue by year's end, four prioritization rules close between 709 and 843 items on the same set, and risk exposure ranges from 6,681 to 18,511 point-weeks. The rule's value depends on capacity: the queue empties at 101 hours/week, and the rules' order reverses at 109 hours/week. 12 min read
- 02 Patch and Change Management In a set of forty announcements, the window length is run as a decision variable: as the window shortens, the caught open findings rise from 23 to 30, but unplanned outages climb from 9 to 50; the two curves cross at day nine, and when the outage cost is raised from 900 to 14,000 risk units, the best window shifts from 1 day to 17 days. The approval gate shortens the window by lowering the error multiplier; the two-path regime cuts the single window's total from 207,637 to 130,159 risk units, and a twelve-announcement misclassification error gives back nine-tenths of that gain. 12 min read
- 03 Security Awareness Training Retention is measured separately for five groups: the return week ranges from 5 to 29, and at a thirteen-week retraining interval the same data produces three different rankings by items, risk units and gain per hour, with all five groups changing place. The same 1,512-hour budget yields 51,066 risk units when distributed to everyone as a single interval and 64,391 when distributed group by group; the most populous group gets no training at all under the first two budgets. 12 min read
- 04 Business Continuity and Disaster Recovery Twelve recovery items are run through both the plan and the drill: the plan's critical path stays under the declared 300-minute target at 260 minutes, the drill measures 421 minutes and overshoots the target by 121 minutes, and only 161 of the drill report's 293 minutes of delay are reflected in recovery time. When a six-person-day budget is spent by report-delay order the gain is zero; spent by critical-path-gain order it is 40 minutes. The cost of dropping below the target ranges from 32 to 21 person-days depending on the ranking measure. 14 min read
- 05 Security Metrics Eighteen program metrics split into four groups: eight carry decisions and take 48 percent of the annual collection cost, two exceed their threshold but drop the signal because they have no defined action, five approach the threshold and never cross it, and three never engage their threshold at all. The most expensive metric costs 192 hours a year and produces zero decisions; six of the eight decision-bearing metrics swap places between the decision-count ranking and the hours-per-decision ranking. 13 min read