Here’s a really cool article on designing research efforts which the security world would do well to learn from.

There are many academic departments (called statistics departments) that study the question of what to do with your data after you collect it. There is not even one department anywhere that studies the question of what data to collect — which is much more important, as every scientist knows.

Much of the discussion around security metrics seems to revolve around the question of what to measure. It’s good to know that we’re not alone in this regard.