Security Metrics ( C )

Security Metrics (http://www.securitymetrics.com) has a rather strange website. Their services are grouped under the products tab on their website, and don't appear to be all that advanced in nature. In fact, from looking at their website we get the feeling that they have "bit hat and no cattle". Which means, they can talk the talk but it doesn't look like they can walk the walk.

We made an attempt to call security metrics and as a result sat bored listening to a horrible soft rock song for about 10 minutes. After which point we were asked by a soft male voice to "Please leave a message". That makes us questions how big of a company security metrics is. Mind you, the size of a company does not always impact the caliber of their deliverables, only sometimes.

One thing for certain is that Security Metrics does make an effort to "look" bigger than they really are. When you click on their "Contact Us" link you are given options for numbers all over the world. How is it that a company that "appears" to be global doesn't even answer their phone, especially their sales line? Doesn't seem too global to us.

On the Security Metrics home page there's a tab of what look like services to the right. This tab shows Site Certification, Audits, MasterCard PTS, Appliance, and Acquirers. The only things that we understand off the bat from the tab are Audits, MasterCard PTS and Site Certifications. But what the hell are Acquirers? (the description for acquirers reads "Use our proven methodology and Merchant Compliance Console for PCI compliance").

When clicking on the products tab our suspicions are confirmed. We are presented with a list of products and services. The first section of the services is "Scanning", which gives us the impression that Security Metrics relies heavily on automation for service delivery. We don't like automated security tests because they are not effective in raising the proverbial security bar. In fact, we feel that automated tests are pretty much useless from a security perspective short of making sure that the right patches are in place. Unfortunately for Security Metrics, their apparent heavy use of automation negatively impacts our opinion of them.

With that being said, we did notice that some of the Security Metrics offerings appear to have manual components to them, but from what we can tell there's only a light manual touch being added. In fact, this is something common to watch out for. Many times a security company will claim that they use a combination of Automated and Manual tests to perform security services. Be careful because often tims those manual tests are as simple as "telnet host 25" to make sure that the service is actually running. If it is then they call the test a positive, if it is not, then its a false positive. That is not manual testing!

Something that we thought was funny about Security Metrics was the text at the bottom of their consulting page. It reads:

Security Crisis Response

If you have a security emergency such as a website defacement, attacker intrusion, internal employee computer misuse, data theft, data destruction, etc. we can help you resolve these incidents. Contact us at 801.705.5665 for immediate assistance with your urgent security issues.

The reason why we think its funny is because we tired to call them and nobody answered. So much for "Security Crisis Response".

Anyway, Security Metrics does not appear to be the hardcore security company with hardcore security offerings, but at the same time they are not a joke. We feel that Security Metrics falls right in the middle as far as capabilities and their service offerings. They are not going to be able to do much to significantly raise the proverbial security bar, but they will be able to provide you with a light weight checkup on a regular scheduled basis.

Score Card (Click to Enlarge)