CISA Releases Its Cybersecurity Strategic Plan
&gt; Drive implementation of measurably effective cybersecurity investments<p>Metrics,metrics,metrics the usgov way.<p>Much if actually effective security is not effective until you get attacked. Especially when it comes to APTs. A huge furstration for me is how management takes the USGOV seriously. I mean, I have no idea what they do internally but their standards and intel are subpar and very slow to adapt to current threats.<p>Most of the things you have to do to defend against APTs are not on NIST CSF or any gov publication I have seen (and i have searched! Just to show value to management). It id like building an ark in the desert, it is far from measurably effective until there is a massive flood and possibly never again.<p>Just one word there makes a huge difference: measurably. If it was &quot;provably&quot; the red teaming can prove the effectivess if defenses but how managers will end up interpreting (not the good ones) this is you need to have KPIs to show for anything you do, so your ability to improve security posture is limited by your ability (give  limited resources) to measure them.<p>Even then, it isn&#x27;t straightforward to simulate zerodays being exploited. You can focus on known exploit primitives being used but it isn&#x27;t uncommon for attacks to use novel techniques that evade your defenses.<p>I wish the usgov will either help or get out of the way. But i am clearly biased in the topic.