Skip to content

Contextualising and Aligning Security Metrics and Business Objectives: a GQM-based Methodology

Research output: Contribution to journalArticle

Original languageEnglish
Article number101634
Number of pages15
JournalComputers and Security
Early online date8 Oct 2019
DateAccepted/In press - 5 Oct 2019
DateE-pub ahead of print - 8 Oct 2019
DatePublished (current) - 1 Jan 2020


Pre-defined security metrics suffer from the problem of contextualisation, i.e. a lack of adaptability to particular organisational contexts – domain, technical infrastructure, stakeholders, business process, etc. Adapting metrics to an organisational context is essential (1) for the metrics to align with business requirements (2) for decision makers to maintain relevant security goals based on measurements from the field. In this paper we propose SYMBIOSIS, a methodology that defines a goal elicitation and refinement process mapping business objectives to security measurement goals via the use of systematic templates that capture relevant context elements (business goals, purpose, stakeholders, system scope). The novel contribution of SYMBIOSIS is the well-defined process, which enforces that (1) metrics align with business objectives via a top-down derivation that refines top-level business objectives to a manageable granularity (2) the impact of metrics on business objectives is explicitly traced via a bottom-up feedback mechanism, allowing an incremental approach where feedback from metrics influences business goals, and vice-versa. In this paper, we discuss the findings from applying SYMBIOSIS to three case studies of known security incidents. Our analysis shows how the aforementioned pitfalls of security metrics development processes affected the outcome of these high-profile security incidents and how SYMBIOSIS addresses such issues.

    Structured keywords

  • Cyber Security

    Research areas

  • Security metrics, Security decision-making, Contextual metrics, Metrics development process, Goal-question-metric (GQM)



  • Full-text PDF (accepted author manuscript)

    Rights statement: This is the author accepted manuscript (AAM). The final published version (version of record) is available online via Elsevier at Please refer to any applicable terms of use of the publisher.

    Accepted author manuscript, 2.33 MB, PDF document

    Embargo ends: 8/10/20

    Request copy

    Licence: CC BY-NC-ND



View research connections

Related faculties, schools or groups